drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/printk.h>
  21 #include <linux/pci_ids.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/interrupt.h>
  24 #include <linux/sched.h>
  25 #include <linux/mmc/sdio.h>
  26 #include <linux/mmc/sdio_func.h>
  27 #include <linux/mmc/card.h>
  28 #include <linux/semaphore.h>
  29 #include <linux/firmware.h>
  30 #include <linux/module.h>
  31 #include <linux/bcma/bcma.h>
  32 #include <linux/debugfs.h>
  33 #include <linux/vmalloc.h>
  34 #include <asm/unaligned.h>
  35 #include <defs.h>
  36 #include <brcmu_wifi.h>
  37 #include <brcmu_utils.h>
  38 #include <brcm_hw_ids.h>
  39 #include <soc.h>
  40 #include "sdio_host.h"
  41 #include "sdio_chip.h"
  42
  43 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
  44
  45 #ifdef DEBUG
  46
  47 #define BRCMF_TRAP_INFO_SIZE    80
  48
  49 #define CBUF_LEN        (128)
  50
  51 /* Device console log buffer state */
  52 #define CONSOLE_BUFFER_MAX      2024
  53
  54 struct rte_log_le {
  55         __le32 buf;             /* Can't be pointer on (64-bit) hosts */
  56         __le32 buf_size;
  57         __le32 idx;
  58         char *_buf_compat;      /* Redundant pointer for backward compat. */
  59 };
  60
  61 struct rte_console {
  62         /* Virtual UART
  63          * When there is no UART (e.g. Quickturn),
  64          * the host should write a complete
  65          * input line directly into cbuf and then write
  66          * the length into vcons_in.
  67          * This may also be used when there is a real UART
  68          * (at risk of conflicting with
  69          * the real UART).  vcons_out is currently unused.
  70          */
  71         uint vcons_in;
  72         uint vcons_out;
  73
  74         /* Output (logging) buffer
  75          * Console output is written to a ring buffer log_buf at index log_idx.
  76          * The host may read the output when it sees log_idx advance.
  77          * Output will be lost if the output wraps around faster than the host
  78          * polls.
  79          */
  80         struct rte_log_le log_le;
  81
  82         /* Console input line buffer
  83          * Characters are read one at a time into cbuf
  84          * until <CR> is received, then
  85          * the buffer is processed as a command line.
  86          * Also used for virtual UART.
  87          */
  88         uint cbuf_idx;
  89         char cbuf[CBUF_LEN];
  90 };
  91
  92 #endif                          /* DEBUG */
  93 #include <chipcommon.h>
  94
  95 #include "dhd_bus.h"
  96 #include "dhd_dbg.h"
  97
  98 #define TXQLEN          2048    /* bulk tx queue length */
  99 #define TXHI            (TXQLEN - 256)  /* turn on flow control above TXHI */
 100 #define TXLOW           (TXHI - 256)    /* turn off flow control below TXLOW */
 101 #define PRIOMASK        7
 102
 103 #define TXRETRIES       2       /* # of retries for tx frames */
 104
 105 #define BRCMF_RXBOUND   50      /* Default for max rx frames in
 106                                  one scheduling */
 107
 108 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
 109                                  one scheduling */
 110
 111 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 112
 113 #define MEMBLOCK        2048    /* Block size used for downloading
 114                                  of dongle image */
 115 #define MAX_DATA_BUF    (32 * 1024)     /* Must be large enough to hold
 116                                  biggest possible glom */
 117
 118 #define BRCMF_FIRSTREAD (1 << 6)
 119
 120
 121 /* SBSDIO_DEVICE_CTL */
 122
 123 /* 1: device will assert busy signal when receiving CMD53 */
 124 #define SBSDIO_DEVCTL_SETBUSY           0x01
 125 /* 1: assertion of sdio interrupt is synchronous to the sdio clock */
 126 #define SBSDIO_DEVCTL_SPI_INTR_SYNC     0x02
 127 /* 1: mask all interrupts to host except the chipActive (rev 8) */
 128 #define SBSDIO_DEVCTL_CA_INT_ONLY       0x04
 129 /* 1: isolate internal sdio signals, put external pads in tri-state; requires
 130  * sdio bus power cycle to clear (rev 9) */
 131 #define SBSDIO_DEVCTL_PADS_ISO          0x08
 132 /* Force SD->SB reset mapping (rev 11) */
 133 #define SBSDIO_DEVCTL_SB_RST_CTL        0x30
 134 /*   Determined by CoreControl bit */
 135 #define SBSDIO_DEVCTL_RST_CORECTL       0x00
 136 /*   Force backplane reset */
 137 #define SBSDIO_DEVCTL_RST_BPRESET       0x10
 138 /*   Force no backplane reset */
 139 #define SBSDIO_DEVCTL_RST_NOBPRESET     0x20
 140
 141 /* direct(mapped) cis space */
 142
 143 /* MAPPED common CIS address */
 144 #define SBSDIO_CIS_BASE_COMMON          0x1000
 145 /* maximum bytes in one CIS */
 146 #define SBSDIO_CIS_SIZE_LIMIT           0x200
 147 /* cis offset addr is < 17 bits */
 148 #define SBSDIO_CIS_OFT_ADDR_MASK        0x1FFFF
 149
 150 /* manfid tuple length, include tuple, link bytes */
 151 #define SBSDIO_CIS_MANFID_TUPLE_LEN     6
 152
 153 /* intstatus */
 154 #define I_SMB_SW0       (1 << 0)        /* To SB Mail S/W interrupt 0 */
 155 #define I_SMB_SW1       (1 << 1)        /* To SB Mail S/W interrupt 1 */
 156 #define I_SMB_SW2       (1 << 2)        /* To SB Mail S/W interrupt 2 */
 157 #define I_SMB_SW3       (1 << 3)        /* To SB Mail S/W interrupt 3 */
 158 #define I_SMB_SW_MASK   0x0000000f      /* To SB Mail S/W interrupts mask */
 159 #define I_SMB_SW_SHIFT  0       /* To SB Mail S/W interrupts shift */
 160 #define I_HMB_SW0       (1 << 4)        /* To Host Mail S/W interrupt 0 */
 161 #define I_HMB_SW1       (1 << 5)        /* To Host Mail S/W interrupt 1 */
 162 #define I_HMB_SW2       (1 << 6)        /* To Host Mail S/W interrupt 2 */
 163 #define I_HMB_SW3       (1 << 7)        /* To Host Mail S/W interrupt 3 */
 164 #define I_HMB_SW_MASK   0x000000f0      /* To Host Mail S/W interrupts mask */
 165 #define I_HMB_SW_SHIFT  4       /* To Host Mail S/W interrupts shift */
 166 #define I_WR_OOSYNC     (1 << 8)        /* Write Frame Out Of Sync */
 167 #define I_RD_OOSYNC     (1 << 9)        /* Read Frame Out Of Sync */
 168 #define I_PC            (1 << 10)       /* descriptor error */
 169 #define I_PD            (1 << 11)       /* data error */
 170 #define I_DE            (1 << 12)       /* Descriptor protocol Error */
 171 #define I_RU            (1 << 13)       /* Receive descriptor Underflow */
 172 #define I_RO            (1 << 14)       /* Receive fifo Overflow */
 173 #define I_XU            (1 << 15)       /* Transmit fifo Underflow */
 174 #define I_RI            (1 << 16)       /* Receive Interrupt */
 175 #define I_BUSPWR        (1 << 17)       /* SDIO Bus Power Change (rev 9) */
 176 #define I_XMTDATA_AVAIL (1 << 23)       /* bits in fifo */
 177 #define I_XI            (1 << 24)       /* Transmit Interrupt */
 178 #define I_RF_TERM       (1 << 25)       /* Read Frame Terminate */
 179 #define I_WF_TERM       (1 << 26)       /* Write Frame Terminate */
 180 #define I_PCMCIA_XU     (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
 181 #define I_SBINT         (1 << 28)       /* sbintstatus Interrupt */
 182 #define I_CHIPACTIVE    (1 << 29)       /* chip from doze to active state */
 183 #define I_SRESET        (1 << 30)       /* CCCR RES interrupt */
 184 #define I_IOE2          (1U << 31)      /* CCCR IOE2 Bit Changed */
 185 #define I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
 186 #define I_DMA           (I_RI | I_XI | I_ERRORS)
 187
 188 /* corecontrol */
 189 #define CC_CISRDY               (1 << 0)        /* CIS Ready */
 190 #define CC_BPRESEN              (1 << 1)        /* CCCR RES signal */
 191 #define CC_F2RDY                (1 << 2)        /* set CCCR IOR2 bit */
 192 #define CC_CLRPADSISO           (1 << 3)        /* clear SDIO pads isolation */
 193 #define CC_XMTDATAAVAIL_MODE    (1 << 4)
 194 #define CC_XMTDATAAVAIL_CTRL    (1 << 5)
 195
 196 /* SDA_FRAMECTRL */
 197 #define SFC_RF_TERM     (1 << 0)        /* Read Frame Terminate */
 198 #define SFC_WF_TERM     (1 << 1)        /* Write Frame Terminate */
 199 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 200 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 201
 202 /* HW frame tag */
 203 #define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
 204
 205 /* Total length of frame header for dongle protocol */
 206 #define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
 207 #define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
 208
 209 /*
 210  * Software allocation of To SB Mailbox resources
 211  */
 212
 213 /* tosbmailbox bits corresponding to intstatus bits */
 214 #define SMB_NAK         (1 << 0)        /* Frame NAK */
 215 #define SMB_INT_ACK     (1 << 1)        /* Host Interrupt ACK */
 216 #define SMB_USE_OOB     (1 << 2)        /* Use OOB Wakeup */
 217 #define SMB_DEV_INT     (1 << 3)        /* Miscellaneous Interrupt */
 218
 219 /* tosbmailboxdata */
 220 #define SMB_DATA_VERSION_SHIFT  16      /* host protocol version */
 221
 222 /*
 223  * Software allocation of To Host Mailbox resources
 224  */
 225
 226 /* intstatus bits */
 227 #define I_HMB_FC_STATE  I_HMB_SW0       /* Flow Control State */
 228 #define I_HMB_FC_CHANGE I_HMB_SW1       /* Flow Control State Changed */
 229 #define I_HMB_FRAME_IND I_HMB_SW2       /* Frame Indication */
 230 #define I_HMB_HOST_INT  I_HMB_SW3       /* Miscellaneous Interrupt */
 231
 232 /* tohostmailboxdata */
 233 #define HMB_DATA_NAKHANDLED     1       /* retransmit NAK'd frame */
 234 #define HMB_DATA_DEVREADY       2       /* talk to host after enable */
 235 #define HMB_DATA_FC             4       /* per prio flowcontrol update flag */
 236 #define HMB_DATA_FWREADY        8       /* fw ready for protocol activity */
 237
 238 #define HMB_DATA_FCDATA_MASK    0xff000000
 239 #define HMB_DATA_FCDATA_SHIFT   24
 240
 241 #define HMB_DATA_VERSION_MASK   0x00ff0000
 242 #define HMB_DATA_VERSION_SHIFT  16
 243
 244 /*
 245  * Software-defined protocol header
 246  */
 247
 248 /* Current protocol version */
 249 #define SDPCM_PROT_VERSION      4
 250
 251 /* SW frame header */
 252 #define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
 253
 254 #define SDPCM_CHANNEL_MASK              0x00000f00
 255 #define SDPCM_CHANNEL_SHIFT             8
 256 #define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
 257
 258 #define SDPCM_NEXTLEN_OFFSET            2
 259
 260 /* Data Offset from SOF (HW Tag, SW Tag, Pad) */
 261 #define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
 262 #define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
 263 #define SDPCM_DOFFSET_MASK              0xff000000
 264 #define SDPCM_DOFFSET_SHIFT             24
 265 #define SDPCM_FCMASK_OFFSET             4       /* Flow control */
 266 #define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
 267 #define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
 268 #define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
 269
 270 #define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
 271
 272 /* logical channel numbers */
 273 #define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
 274 #define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
 275 #define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
 276 #define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
 277 #define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
 278
 279 #define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
 280
 281 #define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
 282
 283 /*
 284  * Shared structure between dongle and the host.
 285  * The structure contains pointers to trap or assert information.
 286  */
 287 #define SDPCM_SHARED_VERSION       0x0003
 288 #define SDPCM_SHARED_VERSION_MASK  0x00FF
 289 #define SDPCM_SHARED_ASSERT_BUILT  0x0100
 290 #define SDPCM_SHARED_ASSERT        0x0200
 291 #define SDPCM_SHARED_TRAP          0x0400
 292
 293 /* Space for header read, limit for data packets */
 294 #define MAX_HDR_READ    (1 << 6)
 295 #define MAX_RX_DATASZ   2048
 296
 297 /* Maximum milliseconds to wait for F2 to come up */
 298 #define BRCMF_WAIT_F2RDY        3000
 299
 300 /* Bump up limit on waiting for HT to account for first startup;
 301  * if the image is doing a CRC calculation before programming the PMU
 302  * for HT availability, it could take a couple hundred ms more, so
 303  * max out at a 1 second (1000000us).
 304  */
 305 #undef PMU_MAX_TRANSITION_DLY
 306 #define PMU_MAX_TRANSITION_DLY 1000000
 307
 308 /* Value for ChipClockCSR during initial setup */
 309 #define BRCMF_INIT_CLKCTL1      (SBSDIO_FORCE_HW_CLKREQ_OFF |   \
 310                                         SBSDIO_ALP_AVAIL_REQ)
 311
 312 /* Flags for SDH calls */
 313 #define F2SYNC  (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
 314
 315 #define BRCMF_SDIO_FW_NAME      "brcm/brcmfmac-sdio.bin"
 316 #define BRCMF_SDIO_NV_NAME      "brcm/brcmfmac-sdio.txt"
 317 MODULE_FIRMWARE(BRCMF_SDIO_FW_NAME);
 318 MODULE_FIRMWARE(BRCMF_SDIO_NV_NAME);
 319
 320 #define BRCMF_IDLE_IMMEDIATE    (-1)    /* Enter idle immediately */
 321 #define BRCMF_IDLE_ACTIVE       0       /* Do not request any SD clock change
 322                                          * when idle
 323                                          */
 324 #define BRCMF_IDLE_INTERVAL     1
 325
 326 /*
 327  * Conversion of 802.1D priority to precedence level
 328  */
 329 static uint prio2prec(u32 prio)
 330 {
 331         return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
 332                (prio^2) : prio;
 333 }
 334
 335 /* core registers */
 336 struct sdpcmd_regs {
 337         u32 corecontrol;                /* 0x00, rev8 */
 338         u32 corestatus;                 /* rev8 */
 339         u32 PAD[1];
 340         u32 biststatus;                 /* rev8 */
 341
 342         /* PCMCIA access */
 343         u16 pcmciamesportaladdr;        /* 0x010, rev8 */
 344         u16 PAD[1];
 345         u16 pcmciamesportalmask;        /* rev8 */
 346         u16 PAD[1];
 347         u16 pcmciawrframebc;            /* rev8 */
 348         u16 PAD[1];
 349         u16 pcmciaunderflowtimer;       /* rev8 */
 350         u16 PAD[1];
 351
 352         /* interrupt */
 353         u32 intstatus;                  /* 0x020, rev8 */
 354         u32 hostintmask;                /* rev8 */
 355         u32 intmask;                    /* rev8 */
 356         u32 sbintstatus;                /* rev8 */
 357         u32 sbintmask;                  /* rev8 */
 358         u32 funcintmask;                /* rev4 */
 359         u32 PAD[2];
 360         u32 tosbmailbox;                /* 0x040, rev8 */
 361         u32 tohostmailbox;              /* rev8 */
 362         u32 tosbmailboxdata;            /* rev8 */
 363         u32 tohostmailboxdata;          /* rev8 */
 364
 365         /* synchronized access to registers in SDIO clock domain */
 366         u32 sdioaccess;                 /* 0x050, rev8 */
 367         u32 PAD[3];
 368
 369         /* PCMCIA frame control */
 370         u8 pcmciaframectrl;             /* 0x060, rev8 */
 371         u8 PAD[3];
 372         u8 pcmciawatermark;             /* rev8 */
 373         u8 PAD[155];
 374
 375         /* interrupt batching control */
 376         u32 intrcvlazy;                 /* 0x100, rev8 */
 377         u32 PAD[3];
 378
 379         /* counters */
 380         u32 cmd52rd;                    /* 0x110, rev8 */
 381         u32 cmd52wr;                    /* rev8 */
 382         u32 cmd53rd;                    /* rev8 */
 383         u32 cmd53wr;                    /* rev8 */
 384         u32 abort;                      /* rev8 */
 385         u32 datacrcerror;               /* rev8 */
 386         u32 rdoutofsync;                /* rev8 */
 387         u32 wroutofsync;                /* rev8 */
 388         u32 writebusy;                  /* rev8 */
 389         u32 readwait;                   /* rev8 */
 390         u32 readterm;                   /* rev8 */
 391         u32 writeterm;                  /* rev8 */
 392         u32 PAD[40];
 393         u32 clockctlstatus;             /* rev8 */
 394         u32 PAD[7];
 395
 396         u32 PAD[128];                   /* DMA engines */
 397
 398         /* SDIO/PCMCIA CIS region */
 399         char cis[512];                  /* 0x400-0x5ff, rev6 */
 400
 401         /* PCMCIA function control registers */
 402         char pcmciafcr[256];            /* 0x600-6ff, rev6 */
 403         u16 PAD[55];
 404
 405         /* PCMCIA backplane access */
 406         u16 backplanecsr;               /* 0x76E, rev6 */
 407         u16 backplaneaddr0;             /* rev6 */
 408         u16 backplaneaddr1;             /* rev6 */
 409         u16 backplaneaddr2;             /* rev6 */
 410         u16 backplaneaddr3;             /* rev6 */
 411         u16 backplanedata0;             /* rev6 */
 412         u16 backplanedata1;             /* rev6 */
 413         u16 backplanedata2;             /* rev6 */
 414         u16 backplanedata3;             /* rev6 */
 415         u16 PAD[31];
 416
 417         /* sprom "size" & "blank" info */
 418         u16 spromstatus;                /* 0x7BE, rev2 */
 419         u32 PAD[464];
 420
 421         u16 PAD[0x80];
 422 };
 423
 424 #ifdef DEBUG
 425 /* Device console log buffer state */
 426 struct brcmf_console {
 427         uint count;             /* Poll interval msec counter */
 428         uint log_addr;          /* Log struct address (fixed) */
 429         struct rte_log_le log_le;       /* Log struct (host copy) */
 430         uint bufsize;           /* Size of log buffer */
 431         u8 *buf;                /* Log buffer (host copy) */
 432         uint last;              /* Last buffer read index */
 433 };
 434
 435 struct brcmf_trap_info {
 436         __le32          type;
 437         __le32          epc;
 438         __le32          cpsr;
 439         __le32          spsr;
 440         __le32          r0;     /* a1 */
 441         __le32          r1;     /* a2 */
 442         __le32          r2;     /* a3 */
 443         __le32          r3;     /* a4 */
 444         __le32          r4;     /* v1 */
 445         __le32          r5;     /* v2 */
 446         __le32          r6;     /* v3 */
 447         __le32          r7;     /* v4 */
 448         __le32          r8;     /* v5 */
 449         __le32          r9;     /* sb/v6 */
 450         __le32          r10;    /* sl/v7 */
 451         __le32          r11;    /* fp/v8 */
 452         __le32          r12;    /* ip */
 453         __le32          r13;    /* sp */
 454         __le32          r14;    /* lr */
 455         __le32          pc;     /* r15 */
 456 };
 457 #endif                          /* DEBUG */
 458
 459 struct sdpcm_shared {
 460         u32 flags;
 461         u32 trap_addr;
 462         u32 assert_exp_addr;
 463         u32 assert_file_addr;
 464         u32 assert_line;
 465         u32 console_addr;       /* Address of struct rte_console */
 466         u32 msgtrace_addr;
 467         u8 tag[32];
 468         u32 brpt_addr;
 469 };
 470
 471 struct sdpcm_shared_le {
 472         __le32 flags;
 473         __le32 trap_addr;
 474         __le32 assert_exp_addr;
 475         __le32 assert_file_addr;
 476         __le32 assert_line;
 477         __le32 console_addr;    /* Address of struct rte_console */
 478         __le32 msgtrace_addr;
 479         u8 tag[32];
 480         __le32 brpt_addr;
 481 };
 482
 483 /* SDIO read frame info */
 484 struct brcmf_sdio_read {
 485         u8 seq_num;
 486         u8 channel;
 487         u16 len;
 488         u16 len_left;
 489         u16 len_nxtfrm;
 490         u8 dat_offset;
 491 };
 492
 493 /* misc chip info needed by some of the routines */
 494 /* Private data for SDIO bus interaction */
 495 struct brcmf_sdio {
 496         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
 497         struct chip_info *ci;   /* Chip info struct */
 498         char *vars;             /* Variables (from CIS and/or other) */
 499         uint varsz;             /* Size of variables buffer */
 500
 501         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 502
 503         u32 hostintmask;        /* Copy of Host Interrupt Mask */
 504         atomic_t intstatus;     /* Intstatus bits (events) pending */
 505         atomic_t fcstate;       /* State of dongle flow-control */
 506
 507         uint blocksize;         /* Block size of SDIO transfers */
 508         uint roundup;           /* Max roundup limit */
 509
 510         struct pktq txq;        /* Queue length used for flow-control */
 511         u8 flowcontrol; /* per prio flow control bitmask */
 512         u8 tx_seq;              /* Transmit sequence number (next) */
 513         u8 tx_max;              /* Maximum transmit sequence allowed */
 514
 515         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
 516         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
 517         u8 rx_seq;              /* Receive sequence number (expected) */
 518         struct brcmf_sdio_read cur_read;
 519                                 /* info of current read frame */
 520         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
 521         bool rxpending;         /* Data frame pending in dongle */
 522
 523         uint rxbound;           /* Rx frames to read before resched */
 524         uint txbound;           /* Tx frames to send before resched */
 525         uint txminmax;
 526
 527         struct sk_buff *glomd;  /* Packet containing glomming descriptor */
 528         struct sk_buff_head glom; /* Packet list for glommed superframe */
 529         uint glomerr;           /* Glom packet read errors */
 530
 531         u8 *rxbuf;              /* Buffer for receiving control packets */
 532         uint rxblen;            /* Allocated length of rxbuf */
 533         u8 *rxctl;              /* Aligned pointer into rxbuf */
 534         u8 *rxctl_orig;         /* pointer for freeing rxctl */
 535         u8 *databuf;            /* Buffer for receiving big glom packet */
 536         u8 *dataptr;            /* Aligned pointer into databuf */
 537         uint rxlen;             /* Length of valid data in buffer */
 538         spinlock_t rxctl_lock;  /* protection lock for ctrl frame resources */
 539
 540         u8 sdpcm_ver;   /* Bus protocol reported by dongle */
 541
 542         bool intr;              /* Use interrupts */
 543         bool poll;              /* Use polling */
 544         atomic_t ipend;         /* Device interrupt is pending */
 545         uint spurious;          /* Count of spurious interrupts */
 546         uint pollrate;          /* Ticks between device polls */
 547         uint polltick;          /* Tick counter */
 548
 549 #ifdef DEBUG
 550         uint console_interval;
 551         struct brcmf_console console;   /* Console output polling support */
 552         uint console_addr;      /* Console address from shared struct */
 553 #endif                          /* DEBUG */
 554
 555         uint clkstate;          /* State of sd and backplane clock(s) */
 556         bool activity;          /* Activity flag for clock down */
 557         s32 idletime;           /* Control for activity timeout */
 558         s32 idlecount;  /* Activity timeout counter */
 559         s32 idleclock;  /* How to set bus driver when idle */
 560         s32 sd_rxchain;
 561         bool use_rxchain;       /* If brcmf should use PKT chains */
 562         bool rxflow_mode;       /* Rx flow control mode */
 563         bool rxflow;            /* Is rx flow control on */
 564         bool alp_only;          /* Don't use HT clock (ALP only) */
 565
 566         u8 *ctrl_frame_buf;
 567         u32 ctrl_frame_len;
 568         bool ctrl_frame_stat;
 569
 570         spinlock_t txqlock;
 571         wait_queue_head_t ctrl_wait;
 572         wait_queue_head_t dcmd_resp_wait;
 573
 574         struct timer_list timer;
 575         struct completion watchdog_wait;
 576         struct task_struct *watchdog_tsk;
 577         bool wd_timer_valid;
 578         uint save_ms;
 579
 580         struct workqueue_struct *brcmf_wq;
 581         struct work_struct datawork;
 582         struct list_head dpc_tsklst;
 583         spinlock_t dpc_tl_lock;
 584
 585         const struct firmware *firmware;
 586         u32 fw_ptr;
 587
 588         bool txoff;             /* Transmit flow-controlled */
 589         struct brcmf_sdio_count sdcnt;
 590 };
 591
 592 /* clkstate */
 593 #define CLK_NONE        0
 594 #define CLK_SDONLY      1
 595 #define CLK_PENDING     2       /* Not used yet */
 596 #define CLK_AVAIL       3
 597
 598 #ifdef DEBUG
 599 static int qcount[NUMPRIO];
 600 static int tx_packets[NUMPRIO];
 601 #endif                          /* DEBUG */
 602
 603 #define SDIO_DRIVE_STRENGTH     6       /* in milliamps */
 604
 605 #define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
 606
 607 /* Retry count for register access failures */
 608 static const uint retry_limit = 2;
 609
 610 /* Limit on rounding up frames */
 611 static const uint max_roundup = 512;
 612
 613 #define ALIGNMENT  4
 614
 615 enum brcmf_sdio_frmtype {
 616         BRCMF_SDIO_FT_NORMAL,
 617         BRCMF_SDIO_FT_SUPER,
 618         BRCMF_SDIO_FT_SUB,
 619 };
 620
 621 static void pkt_align(struct sk_buff *p, int len, int align)
 622 {
 623         uint datalign;
 624         datalign = (unsigned long)(p->data);
 625         datalign = roundup(datalign, (align)) - datalign;
 626         if (datalign)
 627                 skb_pull(p, datalign);
 628         __skb_trim(p, len);
 629 }
 630
 631 /* To check if there's window offered */
 632 static bool data_ok(struct brcmf_sdio *bus)
 633 {
 634         return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
 635                ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
 636 }
 637
 638 /*
 639  * Reads a register in the SDIO hardware block. This block occupies a series of
 640  * adresses on the 32 bit backplane bus.
 641  */
 642 static int
 643 r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
 644 {
 645         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 646         int ret;
 647
 648         *regvar = brcmf_sdio_regrl(bus->sdiodev,
 649                                    bus->ci->c_inf[idx].base + offset, &ret);
 650
 651         return ret;
 652 }
 653
 654 static int
 655 w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
 656 {
 657         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
 658         int ret;
 659
 660         brcmf_sdio_regwl(bus->sdiodev,
 661                          bus->ci->c_inf[idx].base + reg_offset,
 662                          regval, &ret);
 663
 664         return ret;
 665 }
 666
 667 #define PKT_AVAILABLE()         (intstatus & I_HMB_FRAME_IND)
 668
 669 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 670
 671 /* Turn backplane clock on or off */
 672 static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 673 {
 674         int err;
 675         u8 clkctl, clkreq, devctl;
 676         unsigned long timeout;
 677
 678         brcmf_dbg(TRACE, "Enter\n");
 679
 680         clkctl = 0;
 681
 682         if (on) {
 683                 /* Request HT Avail */
 684                 clkreq =
 685                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 686
 687                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 688                                  clkreq, &err);
 689                 if (err) {
 690                         brcmf_err("HT Avail request error: %d\n", err);
 691                         return -EBADE;
 692                 }
 693
 694                 /* Check current status */
 695                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
 696                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
 697                 if (err) {
 698                         brcmf_err("HT Avail read error: %d\n", err);
 699                         return -EBADE;
 700                 }
 701
 702                 /* Go to pending and await interrupt if appropriate */
 703                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
 704                         /* Allow only clock-available interrupt */
 705                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 706                                                   SBSDIO_DEVICE_CTL, &err);
 707                         if (err) {
 708                                 brcmf_err("Devctl error setting CA: %d\n",
 709                                           err);
 710                                 return -EBADE;
 711                         }
 712
 713                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
 714                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 715                                          devctl, &err);
 716                         brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
 717                         bus->clkstate = CLK_PENDING;
 718
 719                         return 0;
 720                 } else if (bus->clkstate == CLK_PENDING) {
 721                         /* Cancel CA-only interrupt filter */
 722                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 723                                                   SBSDIO_DEVICE_CTL, &err);
 724                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 725                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 726                                          devctl, &err);
 727                 }
 728
 729                 /* Otherwise, wait here (polling) for HT Avail */
 730                 timeout = jiffies +
 731                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
 732                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 733                         clkctl = brcmf_sdio_regrb(bus->sdiodev,
 734                                                   SBSDIO_FUNC1_CHIPCLKCSR,
 735                                                   &err);
 736                         if (time_after(jiffies, timeout))
 737                                 break;
 738                         else
 739                                 usleep_range(5000, 10000);
 740                 }
 741                 if (err) {
 742                         brcmf_err("HT Avail request error: %d\n", err);
 743                         return -EBADE;
 744                 }
 745                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
 746                         brcmf_err("HT Avail timeout (%d): clkctl 0x%02x\n",
 747                                   PMU_MAX_TRANSITION_DLY, clkctl);
 748                         return -EBADE;
 749                 }
 750
 751                 /* Mark clock available */
 752                 bus->clkstate = CLK_AVAIL;
 753                 brcmf_dbg(INFO, "CLKCTL: turned ON\n");
 754
 755 #if defined(DEBUG)
 756                 if (!bus->alp_only) {
 757                         if (SBSDIO_ALPONLY(clkctl))
 758                                 brcmf_err("HT Clock should be on\n");
 759                 }
 760 #endif                          /* defined (DEBUG) */
 761
 762                 bus->activity = true;
 763         } else {
 764                 clkreq = 0;
 765
 766                 if (bus->clkstate == CLK_PENDING) {
 767                         /* Cancel CA-only interrupt filter */
 768                         devctl = brcmf_sdio_regrb(bus->sdiodev,
 769                                                   SBSDIO_DEVICE_CTL, &err);
 770                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
 771                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
 772                                          devctl, &err);
 773                 }
 774
 775                 bus->clkstate = CLK_SDONLY;
 776                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
 777                                  clkreq, &err);
 778                 brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
 779                 if (err) {
 780                         brcmf_err("Failed access turning clock off: %d\n",
 781                                   err);
 782                         return -EBADE;
 783                 }
 784         }
 785         return 0;
 786 }
 787
 788 /* Change idle/active SD state */
 789 static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
 790 {
 791         brcmf_dbg(TRACE, "Enter\n");
 792
 793         if (on)
 794                 bus->clkstate = CLK_SDONLY;
 795         else
 796                 bus->clkstate = CLK_NONE;
 797
 798         return 0;
 799 }
 800
 801 /* Transition SD and backplane clock readiness */
 802 static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 803 {
 804 #ifdef DEBUG
 805         uint oldstate = bus->clkstate;
 806 #endif                          /* DEBUG */
 807
 808         brcmf_dbg(TRACE, "Enter\n");
 809
 810         /* Early exit if we're already there */
 811         if (bus->clkstate == target) {
 812                 if (target == CLK_AVAIL) {
 813                         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 814                         bus->activity = true;
 815                 }
 816                 return 0;
 817         }
 818
 819         switch (target) {
 820         case CLK_AVAIL:
 821                 /* Make sure SD clock is available */
 822                 if (bus->clkstate == CLK_NONE)
 823                         brcmf_sdbrcm_sdclk(bus, true);
 824                 /* Now request HT Avail on the backplane */
 825                 brcmf_sdbrcm_htclk(bus, true, pendok);
 826                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 827                 bus->activity = true;
 828                 break;
 829
 830         case CLK_SDONLY:
 831                 /* Remove HT request, or bring up SD clock */
 832                 if (bus->clkstate == CLK_NONE)
 833                         brcmf_sdbrcm_sdclk(bus, true);
 834                 else if (bus->clkstate == CLK_AVAIL)
 835                         brcmf_sdbrcm_htclk(bus, false, false);
 836                 else
 837                         brcmf_err("request for %d -> %d\n",
 838                                   bus->clkstate, target);
 839                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 840                 break;
 841
 842         case CLK_NONE:
 843                 /* Make sure to remove HT request */
 844                 if (bus->clkstate == CLK_AVAIL)
 845                         brcmf_sdbrcm_htclk(bus, false, false);
 846                 /* Now remove the SD clock */
 847                 brcmf_sdbrcm_sdclk(bus, false);
 848                 brcmf_sdbrcm_wd_timer(bus, 0);
 849                 break;
 850         }
 851 #ifdef DEBUG
 852         brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
 853 #endif                          /* DEBUG */
 854
 855         return 0;
 856 }
 857
 858 static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
 859 {
 860         u32 intstatus = 0;
 861         u32 hmb_data;
 862         u8 fcbits;
 863         int ret;
 864
 865         brcmf_dbg(TRACE, "Enter\n");
 866
 867         /* Read mailbox data and ack that we did so */
 868         ret = r_sdreg32(bus, &hmb_data,
 869                         offsetof(struct sdpcmd_regs, tohostmailboxdata));
 870
 871         if (ret == 0)
 872                 w_sdreg32(bus, SMB_INT_ACK,
 873                           offsetof(struct sdpcmd_regs, tosbmailbox));
 874         bus->sdcnt.f1regdata += 2;
 875
 876         /* Dongle recomposed rx frames, accept them again */
 877         if (hmb_data & HMB_DATA_NAKHANDLED) {
 878                 brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
 879                           bus->rx_seq);
 880                 if (!bus->rxskip)
 881                         brcmf_err("unexpected NAKHANDLED!\n");
 882
 883                 bus->rxskip = false;
 884                 intstatus |= I_HMB_FRAME_IND;
 885         }
 886
 887         /*
 888          * DEVREADY does not occur with gSPI.
 889          */
 890         if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
 891                 bus->sdpcm_ver =
 892                     (hmb_data & HMB_DATA_VERSION_MASK) >>
 893                     HMB_DATA_VERSION_SHIFT;
 894                 if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
 895                         brcmf_err("Version mismatch, dongle reports %d, "
 896                                   "expecting %d\n",
 897                                   bus->sdpcm_ver, SDPCM_PROT_VERSION);
 898                 else
 899                         brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
 900                                   bus->sdpcm_ver);
 901         }
 902
 903         /*
 904          * Flow Control has been moved into the RX headers and this out of band
 905          * method isn't used any more.
 906          * remaining backward compatible with older dongles.
 907          */
 908         if (hmb_data & HMB_DATA_FC) {
 909                 fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
 910                                                         HMB_DATA_FCDATA_SHIFT;
 911
 912                 if (fcbits & ~bus->flowcontrol)
 913                         bus->sdcnt.fc_xoff++;
 914
 915                 if (bus->flowcontrol & ~fcbits)
 916                         bus->sdcnt.fc_xon++;
 917
 918                 bus->sdcnt.fc_rcvd++;
 919                 bus->flowcontrol = fcbits;
 920         }
 921
 922         /* Shouldn't be any others */
 923         if (hmb_data & ~(HMB_DATA_DEVREADY |
 924                          HMB_DATA_NAKHANDLED |
 925                          HMB_DATA_FC |
 926                          HMB_DATA_FWREADY |
 927                          HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
 928                 brcmf_err("Unknown mailbox data content: 0x%02x\n",
 929                           hmb_data);
 930
 931         return intstatus;
 932 }
 933
 934 static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
 935 {
 936         uint retries = 0;
 937         u16 lastrbc;
 938         u8 hi, lo;
 939         int err;
 940
 941         brcmf_err("%sterminate frame%s\n",
 942                   abort ? "abort command, " : "",
 943                   rtx ? ", send NAK" : "");
 944
 945         if (abort)
 946                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
 947
 948         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
 949                          SFC_RF_TERM, &err);
 950         bus->sdcnt.f1regdata++;
 951
 952         /* Wait until the packet has been flushed (device/FIFO stable) */
 953         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
 954                 hi = brcmf_sdio_regrb(bus->sdiodev,
 955                                       SBSDIO_FUNC1_RFRAMEBCHI, &err);
 956                 lo = brcmf_sdio_regrb(bus->sdiodev,
 957                                       SBSDIO_FUNC1_RFRAMEBCLO, &err);
 958                 bus->sdcnt.f1regdata += 2;
 959
 960                 if ((hi == 0) && (lo == 0))
 961                         break;
 962
 963                 if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
 964                         brcmf_err("count growing: last 0x%04x now 0x%04x\n",
 965                                   lastrbc, (hi << 8) + lo);
 966                 }
 967                 lastrbc = (hi << 8) + lo;
 968         }
 969
 970         if (!retries)
 971                 brcmf_err("count never zeroed: last 0x%04x\n", lastrbc);
 972         else
 973                 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
 974
 975         if (rtx) {
 976                 bus->sdcnt.rxrtx++;
 977                 err = w_sdreg32(bus, SMB_NAK,
 978                                 offsetof(struct sdpcmd_regs, tosbmailbox));
 979
 980                 bus->sdcnt.f1regdata++;
 981                 if (err == 0)
 982                         bus->rxskip = true;
 983         }
 984
 985         /* Clear partial in any case */
 986         bus->cur_read.len = 0;
 987
 988         /* If we can't reach the device, signal failure */
 989         if (err)
 990                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
 991 }
 992
 993 /* copy a buffer into a pkt buffer chain */
 994 static uint brcmf_sdbrcm_glom_from_buf(struct brcmf_sdio *bus, uint len)
 995 {
 996         uint n, ret = 0;
 997         struct sk_buff *p;
 998         u8 *buf;
 999
1000         buf = bus->dataptr;
1001
1002         /* copy the data */
1003         skb_queue_walk(&bus->glom, p) {
1004                 n = min_t(uint, p->len, len);
1005                 memcpy(p->data, buf, n);
1006                 buf += n;
1007                 len -= n;
1008                 ret += n;
1009                 if (!len)
1010                         break;
1011         }
1012
1013         return ret;
1014 }
1015
1016 /* return total length of buffer chain */
1017 static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
1018 {
1019         struct sk_buff *p;
1020         uint total;
1021
1022         total = 0;
1023         skb_queue_walk(&bus->glom, p)
1024                 total += p->len;
1025         return total;
1026 }
1027
1028 static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
1029 {
1030         struct sk_buff *cur, *next;
1031
1032         skb_queue_walk_safe(&bus->glom, cur, next) {
1033                 skb_unlink(cur, &bus->glom);
1034                 brcmu_pkt_buf_free_skb(cur);
1035         }
1036 }
1037
1038 static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
1039                                struct brcmf_sdio_read *rd,
1040                                enum brcmf_sdio_frmtype type)
1041 {
1042         u16 len, checksum;
1043         u8 rx_seq, fc, tx_seq_max;
1044
1045         /*
1046          * 4 bytes hardware header (frame tag)
1047          * Byte 0~1: Frame length
1048          * Byte 2~3: Checksum, bit-wise inverse of frame length
1049          */
1050         len = get_unaligned_le16(header);
1051         checksum = get_unaligned_le16(header + sizeof(u16));
1052         /* All zero means no more to read */
1053         if (!(len | checksum)) {
1054                 bus->rxpending = false;
1055                 return -ENODATA;
1056         }
1057         if ((u16)(~(len ^ checksum))) {
1058                 brcmf_err("HW header checksum error\n");
1059                 bus->sdcnt.rx_badhdr++;
1060                 brcmf_sdbrcm_rxfail(bus, false, false);
1061                 return -EIO;
1062         }
1063         if (len < SDPCM_HDRLEN) {
1064                 brcmf_err("HW header length error\n");
1065                 return -EPROTO;
1066         }
1067         if (type == BRCMF_SDIO_FT_SUPER &&
1068             (roundup(len, bus->blocksize) != rd->len)) {
1069                 brcmf_err("HW superframe header length error\n");
1070                 return -EPROTO;
1071         }
1072         if (type == BRCMF_SDIO_FT_SUB && len > rd->len) {
1073                 brcmf_err("HW subframe header length error\n");
1074                 return -EPROTO;
1075         }
1076         rd->len = len;
1077
1078         /*
1079          * 8 bytes hardware header
1080          * Byte 0: Rx sequence number
1081          * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
1082          * Byte 2: Length of next data frame
1083          * Byte 3: Data offset
1084          * Byte 4: Flow control bits
1085          * Byte 5: Maximum Sequence number allow for Tx
1086          * Byte 6~7: Reserved
1087          */
1088         if (type == BRCMF_SDIO_FT_SUPER &&
1089             SDPCM_GLOMDESC(&header[SDPCM_FRAMETAG_LEN])) {
1090                 brcmf_err("Glom descriptor found in superframe head\n");
1091                 rd->len = 0;
1092                 return -EINVAL;
1093         }
1094         rx_seq = SDPCM_PACKET_SEQUENCE(&header[SDPCM_FRAMETAG_LEN]);
1095         rd->channel = SDPCM_PACKET_CHANNEL(&header[SDPCM_FRAMETAG_LEN]);
1096         if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL &&
1097             type != BRCMF_SDIO_FT_SUPER) {
1098                 brcmf_err("HW header length too long\n");
1099                 bus->sdcnt.rx_toolong++;
1100                 brcmf_sdbrcm_rxfail(bus, false, false);
1101                 rd->len = 0;
1102                 return -EPROTO;
1103         }
1104         if (type == BRCMF_SDIO_FT_SUPER && rd->channel != SDPCM_GLOM_CHANNEL) {
1105                 brcmf_err("Wrong channel for superframe\n");
1106                 rd->len = 0;
1107                 return -EINVAL;
1108         }
1109         if (type == BRCMF_SDIO_FT_SUB && rd->channel != SDPCM_DATA_CHANNEL &&
1110             rd->channel != SDPCM_EVENT_CHANNEL) {
1111                 brcmf_err("Wrong channel for subframe\n");
1112                 rd->len = 0;
1113                 return -EINVAL;
1114         }
1115         rd->dat_offset = SDPCM_DOFFSET_VALUE(&header[SDPCM_FRAMETAG_LEN]);
1116         if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
1117                 brcmf_err("seq %d: bad data offset\n", rx_seq);
1118                 bus->sdcnt.rx_badhdr++;
1119                 brcmf_sdbrcm_rxfail(bus, false, false);
1120                 rd->len = 0;
1121                 return -ENXIO;
1122         }
1123         if (rd->seq_num != rx_seq) {
1124                 brcmf_err("seq %d: sequence number error, expect %d\n",
1125                           rx_seq, rd->seq_num);
1126                 bus->sdcnt.rx_badseq++;
1127                 rd->seq_num = rx_seq;
1128         }
1129         /* no need to check the reset for subframe */
1130         if (type == BRCMF_SDIO_FT_SUB)
1131                 return 0;
1132         rd->len_nxtfrm = header[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
1133         if (rd->len_nxtfrm << 4 > MAX_RX_DATASZ) {
1134                 /* only warm for NON glom packet */
1135                 if (rd->channel != SDPCM_GLOM_CHANNEL)
1136                         brcmf_err("seq %d: next length error\n", rx_seq);
1137                 rd->len_nxtfrm = 0;
1138         }
1139         fc = SDPCM_FCMASK_VALUE(&header[SDPCM_FRAMETAG_LEN]);
1140         if (bus->flowcontrol != fc) {
1141                 if (~bus->flowcontrol & fc)
1142                         bus->sdcnt.fc_xoff++;
1143                 if (bus->flowcontrol & ~fc)
1144                         bus->sdcnt.fc_xon++;
1145                 bus->sdcnt.fc_rcvd++;
1146                 bus->flowcontrol = fc;
1147         }
1148         tx_seq_max = SDPCM_WINDOW_VALUE(&header[SDPCM_FRAMETAG_LEN]);
1149         if ((u8)(tx_seq_max - bus->tx_seq) > 0x40) {
1150                 brcmf_err("seq %d: max tx seq number error\n", rx_seq);
1151                 tx_seq_max = bus->tx_seq + 2;
1152         }
1153         bus->tx_max = tx_seq_max;
1154
1155         return 0;
1156 }
1157
1158 static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
1159 {
1160         u16 dlen, totlen;
1161         u8 *dptr, num = 0;
1162
1163         u16 sublen;
1164         struct sk_buff *pfirst, *pnext;
1165
1166         int errcode;
1167         u8 doff, sfdoff;
1168
1169         bool usechain = bus->use_rxchain;
1170
1171         struct brcmf_sdio_read rd_new;
1172
1173         /* If packets, issue read(s) and send up packet chain */
1174         /* Return sequence numbers consumed? */
1175
1176         brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
1177                   bus->glomd, skb_peek(&bus->glom));
1178
1179         /* If there's a descriptor, generate the packet chain */
1180         if (bus->glomd) {
1181                 pfirst = pnext = NULL;
1182                 dlen = (u16) (bus->glomd->len);
1183                 dptr = bus->glomd->data;
1184                 if (!dlen || (dlen & 1)) {
1185                         brcmf_err("bad glomd len(%d), ignore descriptor\n",
1186                                   dlen);
1187                         dlen = 0;
1188                 }
1189
1190                 for (totlen = num = 0; dlen; num++) {
1191                         /* Get (and move past) next length */
1192                         sublen = get_unaligned_le16(dptr);
1193                         dlen -= sizeof(u16);
1194                         dptr += sizeof(u16);
1195                         if ((sublen < SDPCM_HDRLEN) ||
1196                             ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
1197                                 brcmf_err("descriptor len %d bad: %d\n",
1198                                           num, sublen);
1199                                 pnext = NULL;
1200                                 break;
1201                         }
1202                         if (sublen % BRCMF_SDALIGN) {
1203                                 brcmf_err("sublen %d not multiple of %d\n",
1204                                           sublen, BRCMF_SDALIGN);
1205                                 usechain = false;
1206                         }
1207                         totlen += sublen;
1208
1209                         /* For last frame, adjust read len so total
1210                                  is a block multiple */
1211                         if (!dlen) {
1212                                 sublen +=
1213                                     (roundup(totlen, bus->blocksize) - totlen);
1214                                 totlen = roundup(totlen, bus->blocksize);
1215                         }
1216
1217                         /* Allocate/chain packet for next subframe */
1218                         pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
1219                         if (pnext == NULL) {
1220                                 brcmf_err("bcm_pkt_buf_get_skb failed, num %d len %d\n",
1221                                           num, sublen);
1222                                 break;
1223                         }
1224                         skb_queue_tail(&bus->glom, pnext);
1225
1226                         /* Adhere to start alignment requirements */
1227                         pkt_align(pnext, sublen, BRCMF_SDALIGN);
1228                 }
1229
1230                 /* If all allocations succeeded, save packet chain
1231                          in bus structure */
1232                 if (pnext) {
1233                         brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
1234                                   totlen, num);
1235                         if (BRCMF_GLOM_ON() && bus->cur_read.len &&
1236                             totlen != bus->cur_read.len) {
1237                                 brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
1238                                           bus->cur_read.len, totlen, rxseq);
1239                         }
1240                         pfirst = pnext = NULL;
1241                 } else {
1242                         brcmf_sdbrcm_free_glom(bus);
1243                         num = 0;
1244                 }
1245
1246                 /* Done with descriptor packet */
1247                 brcmu_pkt_buf_free_skb(bus->glomd);
1248                 bus->glomd = NULL;
1249                 bus->cur_read.len = 0;
1250         }
1251
1252         /* Ok -- either we just generated a packet chain,
1253                  or had one from before */
1254         if (!skb_queue_empty(&bus->glom)) {
1255                 if (BRCMF_GLOM_ON()) {
1256                         brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
1257                         skb_queue_walk(&bus->glom, pnext) {
1258                                 brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
1259                                           pnext, (u8 *) (pnext->data),
1260                                           pnext->len, pnext->len);
1261                         }
1262                 }
1263
1264                 pfirst = skb_peek(&bus->glom);
1265                 dlen = (u16) brcmf_sdbrcm_glom_len(bus);
1266
1267                 /* Do an SDIO read for the superframe.  Configurable iovar to
1268                  * read directly into the chained packet, or allocate a large
1269                  * packet and and copy into the chain.
1270                  */
1271                 sdio_claim_host(bus->sdiodev->func[1]);
1272                 if (usechain) {
1273                         errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
1274                                         bus->sdiodev->sbwad,
1275                                         SDIO_FUNC_2, F2SYNC, &bus->glom);
1276                 } else if (bus->dataptr) {
1277                         errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
1278                                         bus->sdiodev->sbwad,
1279                                         SDIO_FUNC_2, F2SYNC,
1280                                         bus->dataptr, dlen);
1281                         sublen = (u16) brcmf_sdbrcm_glom_from_buf(bus, dlen);
1282                         if (sublen != dlen) {
1283                                 brcmf_err("FAILED TO COPY, dlen %d sublen %d\n",
1284                                           dlen, sublen);
1285                                 errcode = -1;
1286                         }
1287                         pnext = NULL;
1288                 } else {
1289                         brcmf_err("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
1290                                   dlen);
1291                         errcode = -1;
1292                 }
1293                 sdio_release_host(bus->sdiodev->func[1]);
1294                 bus->sdcnt.f2rxdata++;
1295
1296                 /* On failure, kill the superframe, allow a couple retries */
1297                 if (errcode < 0) {
1298                         brcmf_err("glom read of %d bytes failed: %d\n",
1299                                   dlen, errcode);
1300
1301                         sdio_claim_host(bus->sdiodev->func[1]);
1302                         if (bus->glomerr++ < 3) {
1303                                 brcmf_sdbrcm_rxfail(bus, true, true);
1304                         } else {
1305                                 bus->glomerr = 0;
1306                                 brcmf_sdbrcm_rxfail(bus, true, false);
1307                                 bus->sdcnt.rxglomfail++;
1308                                 brcmf_sdbrcm_free_glom(bus);
1309                         }
1310                         sdio_release_host(bus->sdiodev->func[1]);
1311                         return 0;
1312                 }
1313
1314                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1315                                    pfirst->data, min_t(int, pfirst->len, 48),
1316                                    "SUPERFRAME:\n");
1317
1318                 rd_new.seq_num = rxseq;
1319                 rd_new.len = dlen;
1320                 sdio_claim_host(bus->sdiodev->func[1]);
1321                 errcode = brcmf_sdio_hdparser(bus, pfirst->data, &rd_new,
1322                                               BRCMF_SDIO_FT_SUPER);
1323                 sdio_release_host(bus->sdiodev->func[1]);
1324                 bus->cur_read.len = rd_new.len_nxtfrm << 4;
1325
1326                 /* Remove superframe header, remember offset */
1327                 skb_pull(pfirst, rd_new.dat_offset);
1328                 sfdoff = rd_new.dat_offset;
1329                 num = 0;
1330
1331                 /* Validate all the subframe headers */
1332                 skb_queue_walk(&bus->glom, pnext) {
1333                         /* leave when invalid subframe is found */
1334                         if (errcode)
1335                                 break;
1336
1337                         rd_new.len = pnext->len;
1338                         rd_new.seq_num = rxseq++;
1339                         sdio_claim_host(bus->sdiodev->func[1]);
1340                         errcode = brcmf_sdio_hdparser(bus, pnext->data, &rd_new,
1341                                                       BRCMF_SDIO_FT_SUB);
1342                         sdio_release_host(bus->sdiodev->func[1]);
1343                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1344                                            pnext->data, 32, "subframe:\n");
1345
1346                         num++;
1347                 }
1348
1349                 if (errcode) {
1350                         /* Terminate frame on error, request
1351                                  a couple retries */
1352                         sdio_claim_host(bus->sdiodev->func[1]);
1353                         if (bus->glomerr++ < 3) {
1354                                 /* Restore superframe header space */
1355                                 skb_push(pfirst, sfdoff);
1356                                 brcmf_sdbrcm_rxfail(bus, true, true);
1357                         } else {
1358                                 bus->glomerr = 0;
1359                                 brcmf_sdbrcm_rxfail(bus, true, false);
1360                                 bus->sdcnt.rxglomfail++;
1361                                 brcmf_sdbrcm_free_glom(bus);
1362                         }
1363                         sdio_release_host(bus->sdiodev->func[1]);
1364                         bus->cur_read.len = 0;
1365                         return 0;
1366                 }
1367
1368                 /* Basic SD framing looks ok - process each packet (header) */
1369
1370                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
1371                         dptr = (u8 *) (pfirst->data);
1372                         sublen = get_unaligned_le16(dptr);
1373                         doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
1374
1375                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1376                                            dptr, pfirst->len,
1377                                            "Rx Subframe Data:\n");
1378
1379                         __skb_trim(pfirst, sublen);
1380                         skb_pull(pfirst, doff);
1381
1382                         if (pfirst->len == 0) {
1383                                 skb_unlink(pfirst, &bus->glom);
1384                                 brcmu_pkt_buf_free_skb(pfirst);
1385                                 continue;
1386                         }
1387
1388                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1389                                            pfirst->data,
1390                                            min_t(int, pfirst->len, 32),
1391                                            "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
1392                                            bus->glom.qlen, pfirst, pfirst->data,
1393                                            pfirst->len, pfirst->next,
1394                                            pfirst->prev);
1395                 }
1396                 /* sent any remaining packets up */
1397                 if (bus->glom.qlen)
1398                         brcmf_rx_frames(bus->sdiodev->dev, &bus->glom);
1399
1400                 bus->sdcnt.rxglomframes++;
1401                 bus->sdcnt.rxglompkts += bus->glom.qlen;
1402         }
1403         return num;
1404 }
1405
1406 static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
1407                                         bool *pending)
1408 {
1409         DECLARE_WAITQUEUE(wait, current);
1410         int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
1411
1412         /* Wait until control frame is available */
1413         add_wait_queue(&bus->dcmd_resp_wait, &wait);
1414         set_current_state(TASK_INTERRUPTIBLE);
1415
1416         while (!(*condition) && (!signal_pending(current) && timeout))
1417                 timeout = schedule_timeout(timeout);
1418
1419         if (signal_pending(current))
1420                 *pending = true;
1421
1422         set_current_state(TASK_RUNNING);
1423         remove_wait_queue(&bus->dcmd_resp_wait, &wait);
1424
1425         return timeout;
1426 }
1427
1428 static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
1429 {
1430         if (waitqueue_active(&bus->dcmd_resp_wait))
1431                 wake_up_interruptible(&bus->dcmd_resp_wait);
1432
1433         return 0;
1434 }
1435 static void
1436 brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
1437 {
1438         uint rdlen, pad;
1439         u8 *buf = NULL, *rbuf;
1440         int sdret;
1441
1442         brcmf_dbg(TRACE, "Enter\n");
1443
1444         if (bus->rxblen)
1445                 buf = vzalloc(bus->rxblen);
1446         if (!buf)
1447                 goto done;
1448
1449         rbuf = bus->rxbuf;
1450         pad = ((unsigned long)rbuf % BRCMF_SDALIGN);
1451         if (pad)
1452                 rbuf += (BRCMF_SDALIGN - pad);
1453
1454         /* Copy the already-read portion over */
1455         memcpy(buf, hdr, BRCMF_FIRSTREAD);
1456         if (len <= BRCMF_FIRSTREAD)
1457                 goto gotpkt;
1458
1459         /* Raise rdlen to next SDIO block to avoid tail command */
1460         rdlen = len - BRCMF_FIRSTREAD;
1461         if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
1462                 pad = bus->blocksize - (rdlen % bus->blocksize);
1463                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
1464                     ((len + pad) < bus->sdiodev->bus_if->maxctl))
1465                         rdlen += pad;
1466         } else if (rdlen % BRCMF_SDALIGN) {
1467                 rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
1468         }
1469
1470         /* Satisfy length-alignment requirements */
1471         if (rdlen & (ALIGNMENT - 1))
1472                 rdlen = roundup(rdlen, ALIGNMENT);
1473
1474         /* Drop if the read is too big or it exceeds our maximum */
1475         if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
1476                 brcmf_err("%d-byte control read exceeds %d-byte buffer\n",
1477                           rdlen, bus->sdiodev->bus_if->maxctl);
1478                 brcmf_sdbrcm_rxfail(bus, false, false);
1479                 goto done;
1480         }
1481
1482         if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
1483                 brcmf_err("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
1484                           len, len - doff, bus->sdiodev->bus_if->maxctl);
1485                 bus->sdcnt.rx_toolong++;
1486                 brcmf_sdbrcm_rxfail(bus, false, false);
1487                 goto done;
1488         }
1489
1490         /* Read remain of frame body */
1491         sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
1492                                 bus->sdiodev->sbwad,
1493                                 SDIO_FUNC_2,
1494                                 F2SYNC, rbuf, rdlen);
1495         bus->sdcnt.f2rxdata++;
1496
1497         /* Control frame failures need retransmission */
1498         if (sdret < 0) {
1499                 brcmf_err("read %d control bytes failed: %d\n",
1500                           rdlen, sdret);
1501                 bus->sdcnt.rxc_errors++;
1502                 brcmf_sdbrcm_rxfail(bus, true, true);
1503                 goto done;
1504         } else
1505                 memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen);
1506
1507 gotpkt:
1508
1509         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
1510                            buf, len, "RxCtrl:\n");
1511
1512         /* Point to valid data and indicate its length */
1513         spin_lock_bh(&bus->rxctl_lock);
1514         if (bus->rxctl) {
1515                 brcmf_err("last control frame is being processed.\n");
1516                 spin_unlock_bh(&bus->rxctl_lock);
1517                 vfree(buf);
1518                 goto done;
1519         }
1520         bus->rxctl = buf + doff;
1521         bus->rxctl_orig = buf;
1522         bus->rxlen = len - doff;
1523         spin_unlock_bh(&bus->rxctl_lock);
1524
1525 done:
1526         /* Awake any waiters */
1527         brcmf_sdbrcm_dcmd_resp_wake(bus);
1528 }
1529
1530 /* Pad read to blocksize for efficiency */
1531 static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
1532 {
1533         if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
1534                 *pad = bus->blocksize - (*rdlen % bus->blocksize);
1535                 if (*pad <= bus->roundup && *pad < bus->blocksize &&
1536                     *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
1537                         *rdlen += *pad;
1538         } else if (*rdlen % BRCMF_SDALIGN) {
1539                 *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
1540         }
1541 }
1542
1543 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
1544 {
1545         struct sk_buff *pkt;            /* Packet for event or data frames */
1546         struct sk_buff_head pktlist;    /* needed for bus interface */
1547         u16 pad;                /* Number of pad bytes to read */
1548         uint rxleft = 0;        /* Remaining number of frames allowed */
1549         int ret;                /* Return code from calls */
1550         uint rxcount = 0;       /* Total frames read */
1551         struct brcmf_sdio_read *rd = &bus->cur_read, rd_new;
1552         u8 head_read = 0;
1553
1554         brcmf_dbg(TRACE, "Enter\n");
1555
1556         /* Not finished unless we encounter no more frames indication */
1557         bus->rxpending = true;
1558
1559         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
1560              !bus->rxskip && rxleft &&
1561              bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN;
1562              rd->seq_num++, rxleft--) {
1563
1564                 /* Handle glomming separately */
1565                 if (bus->glomd || !skb_queue_empty(&bus->glom)) {
1566                         u8 cnt;
1567                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
1568                                   bus->glomd, skb_peek(&bus->glom));
1569                         cnt = brcmf_sdbrcm_rxglom(bus, rd->seq_num);
1570                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
1571                         rd->seq_num += cnt - 1;
1572                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
1573                         continue;
1574                 }
1575
1576                 rd->len_left = rd->len;
1577                 /* read header first for unknow frame length */
1578                 sdio_claim_host(bus->sdiodev->func[1]);
1579                 if (!rd->len) {
1580                         ret = brcmf_sdcard_recv_buf(bus->sdiodev,
1581                                                       bus->sdiodev->sbwad,
1582                                                       SDIO_FUNC_2, F2SYNC,
1583                                                       bus->rxhdr,
1584                                                       BRCMF_FIRSTREAD);
1585                         bus->sdcnt.f2rxhdrs++;
1586                         if (ret < 0) {
1587                                 brcmf_err("RXHEADER FAILED: %d\n",
1588                                           ret);
1589                                 bus->sdcnt.rx_hdrfail++;
1590                                 brcmf_sdbrcm_rxfail(bus, true, true);
1591                                 sdio_release_host(bus->sdiodev->func[1]);
1592                                 continue;
1593                         }
1594
1595                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() || BRCMF_HDRS_ON(),
1596                                            bus->rxhdr, SDPCM_HDRLEN,
1597                                            "RxHdr:\n");
1598
1599                         if (brcmf_sdio_hdparser(bus, bus->rxhdr, rd,
1600                                                 BRCMF_SDIO_FT_NORMAL)) {
1601                                 sdio_release_host(bus->sdiodev->func[1]);
1602                                 if (!bus->rxpending)
1603                                         break;
1604                                 else
1605                                         continue;
1606                         }
1607
1608                         if (rd->channel == SDPCM_CONTROL_CHANNEL) {
1609                                 brcmf_sdbrcm_read_control(bus, bus->rxhdr,
1610                                                           rd->len,
1611                                                           rd->dat_offset);
1612                                 /* prepare the descriptor for the next read */
1613                                 rd->len = rd->len_nxtfrm << 4;
1614                                 rd->len_nxtfrm = 0;
1615                                 /* treat all packet as event if we don't know */
1616                                 rd->channel = SDPCM_EVENT_CHANNEL;
1617                                 sdio_release_host(bus->sdiodev->func[1]);
1618                                 continue;
1619                         }
1620                         rd->len_left = rd->len > BRCMF_FIRSTREAD ?
1621                                        rd->len - BRCMF_FIRSTREAD : 0;
1622                         head_read = BRCMF_FIRSTREAD;
1623                 }
1624
1625                 brcmf_pad(bus, &pad, &rd->len_left);
1626
1627                 pkt = brcmu_pkt_buf_get_skb(rd->len_left + head_read +
1628                                             BRCMF_SDALIGN);
1629                 if (!pkt) {
1630                         /* Give up on data, request rtx of events */
1631                         brcmf_err("brcmu_pkt_buf_get_skb failed\n");
1632                         brcmf_sdbrcm_rxfail(bus, false,
1633                                             RETRYCHAN(rd->channel));
1634                         sdio_release_host(bus->sdiodev->func[1]);
1635                         continue;
1636                 }
1637                 skb_pull(pkt, head_read);
1638                 pkt_align(pkt, rd->len_left, BRCMF_SDALIGN);
1639
1640                 ret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1641                                               SDIO_FUNC_2, F2SYNC, pkt);
1642                 bus->sdcnt.f2rxdata++;
1643                 sdio_release_host(bus->sdiodev->func[1]);
1644
1645                 if (ret < 0) {
1646                         brcmf_err("read %d bytes from channel %d failed: %d\n",
1647                                   rd->len, rd->channel, ret);
1648                         brcmu_pkt_buf_free_skb(pkt);
1649                         sdio_claim_host(bus->sdiodev->func[1]);
1650                         brcmf_sdbrcm_rxfail(bus, true,
1651                                             RETRYCHAN(rd->channel));
1652                         sdio_release_host(bus->sdiodev->func[1]);
1653                         continue;
1654                 }
1655
1656                 if (head_read) {
1657                         skb_push(pkt, head_read);
1658                         memcpy(pkt->data, bus->rxhdr, head_read);
1659                         head_read = 0;
1660                 } else {
1661                         memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
1662                         rd_new.seq_num = rd->seq_num;
1663                         sdio_claim_host(bus->sdiodev->func[1]);
1664                         if (brcmf_sdio_hdparser(bus, bus->rxhdr, &rd_new,
1665                                                 BRCMF_SDIO_FT_NORMAL)) {
1666                                 rd->len = 0;
1667                                 brcmu_pkt_buf_free_skb(pkt);
1668                         }
1669                         bus->sdcnt.rx_readahead_cnt++;
1670                         if (rd->len != roundup(rd_new.len, 16)) {
1671                                 brcmf_err("frame length mismatch:read %d, should be %d\n",
1672                                           rd->len,
1673                                           roundup(rd_new.len, 16) >> 4);
1674                                 rd->len = 0;
1675                                 brcmf_sdbrcm_rxfail(bus, true, true);
1676                                 sdio_release_host(bus->sdiodev->func[1]);
1677                                 brcmu_pkt_buf_free_skb(pkt);
1678                                 continue;
1679                         }
1680                         sdio_release_host(bus->sdiodev->func[1]);
1681                         rd->len_nxtfrm = rd_new.len_nxtfrm;
1682                         rd->channel = rd_new.channel;
1683                         rd->dat_offset = rd_new.dat_offset;
1684
1685                         brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
1686                                              BRCMF_DATA_ON()) &&
1687                                            BRCMF_HDRS_ON(),
1688                                            bus->rxhdr, SDPCM_HDRLEN,
1689                                            "RxHdr:\n");
1690
1691                         if (rd_new.channel == SDPCM_CONTROL_CHANNEL) {
1692                                 brcmf_err("readahead on control packet %d?\n",
1693                                           rd_new.seq_num);
1694                                 /* Force retry w/normal header read */
1695                                 rd->len = 0;
1696                                 sdio_claim_host(bus->sdiodev->func[1]);
1697                                 brcmf_sdbrcm_rxfail(bus, false, true);
1698                                 sdio_release_host(bus->sdiodev->func[1]);
1699                                 brcmu_pkt_buf_free_skb(pkt);
1700                                 continue;
1701                         }
1702                 }
1703
1704                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
1705                                    pkt->data, rd->len, "Rx Data:\n");
1706
1707                 /* Save superframe descriptor and allocate packet frame */
1708                 if (rd->channel == SDPCM_GLOM_CHANNEL) {
1709                         if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
1710                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
1711                                           rd->len);
1712                                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
1713                                                    pkt->data, rd->len,
1714                                                    "Glom Data:\n");
1715                                 __skb_trim(pkt, rd->len);
1716                                 skb_pull(pkt, SDPCM_HDRLEN);
1717                                 bus->glomd = pkt;
1718                         } else {
1719                                 brcmf_err("%s: glom superframe w/o "
1720                                           "descriptor!\n", __func__);
1721                                 sdio_claim_host(bus->sdiodev->func[1]);
1722                                 brcmf_sdbrcm_rxfail(bus, false, false);
1723                                 sdio_release_host(bus->sdiodev->func[1]);
1724                         }
1725                         /* prepare the descriptor for the next read */
1726                         rd->len = rd->len_nxtfrm << 4;
1727                         rd->len_nxtfrm = 0;
1728                         /* treat all packet as event if we don't know */
1729                         rd->channel = SDPCM_EVENT_CHANNEL;
1730                         continue;
1731                 }
1732
1733                 /* Fill in packet len and prio, deliver upward */
1734                 __skb_trim(pkt, rd->len);
1735                 skb_pull(pkt, rd->dat_offset);
1736
1737                 /* prepare the descriptor for the next read */
1738                 rd->len = rd->len_nxtfrm << 4;
1739                 rd->len_nxtfrm = 0;
1740                 /* treat all packet as event if we don't know */
1741                 rd->channel = SDPCM_EVENT_CHANNEL;
1742
1743                 if (pkt->len == 0) {
1744                         brcmu_pkt_buf_free_skb(pkt);
1745                         continue;
1746                 }
1747
1748                 skb_queue_head_init(&pktlist);
1749                 skb_queue_tail(&pktlist, pkt);
1750                 brcmf_rx_frames(bus->sdiodev->dev, &pktlist);
1751         }
1752
1753         rxcount = maxframes - rxleft;
1754         /* Message if we hit the limit */
1755         if (!rxleft)
1756                 brcmf_dbg(DATA, "hit rx limit of %d frames\n", maxframes);
1757         else
1758                 brcmf_dbg(DATA, "processed %d frames\n", rxcount);
1759         /* Back off rxseq if awaiting rtx, update rx_seq */
1760         if (bus->rxskip)
1761                 rd->seq_num--;
1762         bus->rx_seq = rd->seq_num;
1763
1764         return rxcount;
1765 }
1766
1767 static void
1768 brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
1769 {
1770         if (waitqueue_active(&bus->ctrl_wait))
1771                 wake_up_interruptible(&bus->ctrl_wait);
1772         return;
1773 }
1774
1775 /* Writes a HW/SW header into the packet and sends it. */
1776 /* Assumes: (a) header space already there, (b) caller holds lock */
1777 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
1778                               uint chan)
1779 {
1780         int ret;
1781         u8 *frame;
1782         u16 len, pad = 0;
1783         u32 swheader;
1784         struct sk_buff *new;
1785         int i;
1786
1787         brcmf_dbg(TRACE, "Enter\n");
1788
1789         frame = (u8 *) (pkt->data);
1790
1791         /* Add alignment padding, allocate new packet if needed */
1792         pad = ((unsigned long)frame % BRCMF_SDALIGN);
1793         if (pad) {
1794                 if (skb_headroom(pkt) < pad) {
1795                         brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
1796                                   skb_headroom(pkt), pad);
1797                         bus->sdiodev->bus_if->tx_realloc++;
1798                         new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
1799                         if (!new) {
1800                                 brcmf_err("couldn't allocate new %d-byte packet\n",
1801                                           pkt->len + BRCMF_SDALIGN);
1802                                 ret = -ENOMEM;
1803                                 goto done;
1804                         }
1805
1806                         pkt_align(new, pkt->len, BRCMF_SDALIGN);
1807                         memcpy(new->data, pkt->data, pkt->len);
1808                         brcmu_pkt_buf_free_skb(pkt);
1809                         pkt = new;
1810                         frame = (u8 *) (pkt->data);
1811                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
1812                         pad = 0;
1813                 } else {
1814                         skb_push(pkt, pad);
1815                         frame = (u8 *) (pkt->data);
1816                         memset(frame + SDPCM_HDRLEN, 0, pad);
1817                 }
1818         }
1819         /* precondition: pad < BRCMF_SDALIGN */
1820
1821         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
1822         len = (u16) (pkt->len);
1823         *(__le16 *) frame = cpu_to_le16(len);
1824         *(((__le16 *) frame) + 1) = cpu_to_le16(~len);
1825
1826         /* Software tag: channel, sequence number, data offset */
1827         swheader =
1828             ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
1829             (((pad +
1830                SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
1831
1832         *(((__le32 *) frame) + 1) = cpu_to_le32(swheader);
1833         *(((__le32 *) frame) + 2) = 0;
1834
1835 #ifdef DEBUG
1836         tx_packets[pkt->priority]++;
1837 #endif
1838
1839         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() &&
1840                            ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
1841                             (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)),
1842                            frame, len, "Tx Frame:\n");
1843         brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
1844                              ((BRCMF_CTL_ON() &&
1845                                chan == SDPCM_CONTROL_CHANNEL) ||
1846                               (BRCMF_DATA_ON() &&
1847                                chan != SDPCM_CONTROL_CHANNEL))) &&
1848                            BRCMF_HDRS_ON(),
1849                            frame, min_t(u16, len, 16), "TxHdr:\n");
1850
1851         /* Raise len to next SDIO block to eliminate tail command */
1852         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
1853                 u16 pad = bus->blocksize - (len % bus->blocksize);
1854                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
1855                                 len += pad;
1856         } else if (len % BRCMF_SDALIGN) {
1857                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
1858         }
1859
1860         /* Some controllers have trouble with odd bytes -- round to even */
1861         if (len & (ALIGNMENT - 1))
1862                         len = roundup(len, ALIGNMENT);
1863
1864         sdio_claim_host(bus->sdiodev->func[1]);
1865         ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
1866                                     SDIO_FUNC_2, F2SYNC, pkt);
1867         bus->sdcnt.f2txdata++;
1868
1869         if (ret < 0) {
1870                 /* On failure, abort the command and terminate the frame */
1871                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
1872                           ret);
1873                 bus->sdcnt.tx_sderrs++;
1874
1875                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
1876                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
1877                                  SFC_WF_TERM, NULL);
1878                 bus->sdcnt.f1regdata++;
1879
1880                 for (i = 0; i < 3; i++) {
1881                         u8 hi, lo;
1882                         hi = brcmf_sdio_regrb(bus->sdiodev,
1883                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
1884                         lo = brcmf_sdio_regrb(bus->sdiodev,
1885                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
1886                         bus->sdcnt.f1regdata += 2;
1887                         if ((hi == 0) && (lo == 0))
1888                                 break;
1889                 }
1890
1891         }
1892         sdio_release_host(bus->sdiodev->func[1]);
1893         if (ret == 0)
1894                 bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
1895
1896 done:
1897         /* restore pkt buffer pointer before calling tx complete routine */
1898         skb_pull(pkt, SDPCM_HDRLEN + pad);
1899         brcmf_txcomplete(bus->sdiodev->dev, pkt, ret == 0);
1900         return ret;
1901 }
1902
1903 static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
1904 {
1905         struct sk_buff *pkt;
1906         u32 intstatus = 0;
1907         int ret = 0, prec_out;
1908         uint cnt = 0;
1909         uint datalen;
1910         u8 tx_prec_map;
1911
1912         brcmf_dbg(TRACE, "Enter\n");
1913
1914         tx_prec_map = ~bus->flowcontrol;
1915
1916         /* Send frames until the limit or some other event */
1917         for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
1918                 spin_lock_bh(&bus->txqlock);
1919                 pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
1920                 if (pkt == NULL) {
1921                         spin_unlock_bh(&bus->txqlock);
1922                         break;
1923                 }
1924                 spin_unlock_bh(&bus->txqlock);
1925                 datalen = pkt->len - SDPCM_HDRLEN;
1926
1927                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL);
1928
1929                 /* In poll mode, need to check for other events */
1930                 if (!bus->intr && cnt) {
1931                         /* Check device status, signal pending interrupt */
1932                         sdio_claim_host(bus->sdiodev->func[1]);
1933                         ret = r_sdreg32(bus, &intstatus,
1934                                         offsetof(struct sdpcmd_regs,
1935                                                  intstatus));
1936                         sdio_release_host(bus->sdiodev->func[1]);
1937                         bus->sdcnt.f2txdata++;
1938                         if (ret != 0)
1939                                 break;
1940                         if (intstatus & bus->hostintmask)
1941                                 atomic_set(&bus->ipend, 1);
1942                 }
1943         }
1944
1945         /* Deflow-control stack if needed */
1946         if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
1947             bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
1948                 bus->txoff = false;
1949                 brcmf_txflowblock(bus->sdiodev->dev, false);
1950         }
1951
1952         return cnt;
1953 }
1954
1955 static void brcmf_sdbrcm_bus_stop(struct device *dev)
1956 {
1957         u32 local_hostintmask;
1958         u8 saveclk;
1959         int err;
1960         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1961         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
1962         struct brcmf_sdio *bus = sdiodev->bus;
1963
1964         brcmf_dbg(TRACE, "Enter\n");
1965
1966         if (bus->watchdog_tsk) {
1967                 send_sig(SIGTERM, bus->watchdog_tsk, 1);
1968                 kthread_stop(bus->watchdog_tsk);
1969                 bus->watchdog_tsk = NULL;
1970         }
1971
1972         sdio_claim_host(bus->sdiodev->func[1]);
1973
1974         /* Enable clock for device interrupts */
1975         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
1976
1977         /* Disable and clear interrupts at the chip level also */
1978         w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
1979         local_hostintmask = bus->hostintmask;
1980         bus->hostintmask = 0;
1981
1982         /* Change our idea of bus state */
1983         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
1984
1985         /* Force clocks on backplane to be sure F2 interrupt propagates */
1986         saveclk = brcmf_sdio_regrb(bus->sdiodev,
1987                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
1988         if (!err) {
1989                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
1990                                  (saveclk | SBSDIO_FORCE_HT), &err);
1991         }
1992         if (err)
1993                 brcmf_err("Failed to force clock for F2: err %d\n", err);
1994
1995         /* Turn off the bus (F2), free any pending packets */
1996         brcmf_dbg(INTR, "disable SDIO interrupts\n");
1997         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, SDIO_FUNC_ENABLE_1,
1998                          NULL);
1999
2000         /* Clear any pending interrupts now that F2 is disabled */
2001         w_sdreg32(bus, local_hostintmask,
2002                   offsetof(struct sdpcmd_regs, intstatus));
2003
2004         /* Turn off the backplane clock (only) */
2005         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
2006         sdio_release_host(bus->sdiodev->func[1]);
2007
2008         /* Clear the data packet queues */
2009         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
2010
2011         /* Clear any held glomming stuff */
2012         if (bus->glomd)
2013                 brcmu_pkt_buf_free_skb(bus->glomd);
2014         brcmf_sdbrcm_free_glom(bus);
2015
2016         /* Clear rx control and wake any waiters */
2017         spin_lock_bh(&bus->rxctl_lock);
2018         bus->rxlen = 0;
2019         spin_unlock_bh(&bus->rxctl_lock);
2020         brcmf_sdbrcm_dcmd_resp_wake(bus);
2021
2022         /* Reset some F2 state stuff */
2023         bus->rxskip = false;
2024         bus->tx_seq = bus->rx_seq = 0;
2025 }
2026
2027 #ifdef CONFIG_BRCMFMAC_SDIO_OOB
2028 static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
2029 {
2030         unsigned long flags;
2031
2032         spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
2033         if (!bus->sdiodev->irq_en && !atomic_read(&bus->ipend)) {
2034                 enable_irq(bus->sdiodev->irq);
2035                 bus->sdiodev->irq_en = true;
2036         }
2037         spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
2038 }
2039 #else
2040 static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
2041 {
2042 }
2043 #endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
2044
2045 static inline void brcmf_sdbrcm_adddpctsk(struct brcmf_sdio *bus)
2046 {
2047         struct list_head *new_hd;
2048         unsigned long flags;
2049
2050         if (in_interrupt())
2051                 new_hd = kzalloc(sizeof(struct list_head), GFP_ATOMIC);
2052         else
2053                 new_hd = kzalloc(sizeof(struct list_head), GFP_KERNEL);
2054         if (new_hd == NULL)
2055                 return;
2056
2057         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
2058         list_add_tail(new_hd, &bus->dpc_tsklst);
2059         spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2060 }
2061
2062 static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
2063 {
2064         u8 idx;
2065         u32 addr;
2066         unsigned long val;
2067         int n, ret;
2068
2069         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
2070         addr = bus->ci->c_inf[idx].base +
2071                offsetof(struct sdpcmd_regs, intstatus);
2072
2073         ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, false);
2074         bus->sdcnt.f1regdata++;
2075         if (ret != 0)
2076                 val = 0;
2077
2078         val &= bus->hostintmask;
2079         atomic_set(&bus->fcstate, !!(val & I_HMB_FC_STATE));
2080
2081         /* Clear interrupts */
2082         if (val) {
2083                 ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, true);
2084                 bus->sdcnt.f1regdata++;
2085         }
2086
2087         if (ret) {
2088                 atomic_set(&bus->intstatus, 0);
2089         } else if (val) {
2090                 for_each_set_bit(n, &val, 32)
2091                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2092         }
2093
2094         return ret;
2095 }
2096
2097 static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
2098 {
2099         u32 newstatus = 0;
2100         unsigned long intstatus;
2101         uint rxlimit = bus->rxbound;    /* Rx frames to read before resched */
2102         uint txlimit = bus->txbound;    /* Tx frames to send before resched */
2103         uint framecnt = 0;      /* Temporary counter of tx/rx frames */
2104         int err = 0, n;
2105
2106         brcmf_dbg(TRACE, "Enter\n");
2107
2108         sdio_claim_host(bus->sdiodev->func[1]);
2109
2110         /* If waiting for HTAVAIL, check status */
2111         if (bus->clkstate == CLK_PENDING) {
2112                 u8 clkctl, devctl = 0;
2113
2114 #ifdef DEBUG
2115                 /* Check for inconsistent device control */
2116                 devctl = brcmf_sdio_regrb(bus->sdiodev,
2117                                           SBSDIO_DEVICE_CTL, &err);
2118                 if (err) {
2119                         brcmf_err("error reading DEVCTL: %d\n", err);
2120                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2121                 }
2122 #endif                          /* DEBUG */
2123
2124                 /* Read CSR, if clock on switch to AVAIL, else ignore */
2125                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
2126                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
2127                 if (err) {
2128                         brcmf_err("error reading CSR: %d\n",
2129                                   err);
2130                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2131                 }
2132
2133                 brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
2134                           devctl, clkctl);
2135
2136                 if (SBSDIO_HTAV(clkctl)) {
2137                         devctl = brcmf_sdio_regrb(bus->sdiodev,
2138                                                   SBSDIO_DEVICE_CTL, &err);
2139                         if (err) {
2140                                 brcmf_err("error reading DEVCTL: %d\n",
2141                                           err);
2142                                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2143                         }
2144                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
2145                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
2146                                          devctl, &err);
2147                         if (err) {
2148                                 brcmf_err("error writing DEVCTL: %d\n",
2149                                           err);
2150                                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2151                         }
2152                         bus->clkstate = CLK_AVAIL;
2153                 }
2154         }
2155
2156         /* Make sure backplane clock is on */
2157         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
2158
2159         /* Pending interrupt indicates new device status */
2160         if (atomic_read(&bus->ipend) > 0) {
2161                 atomic_set(&bus->ipend, 0);
2162                 err = brcmf_sdio_intr_rstatus(bus);
2163         }
2164
2165         /* Start with leftover status bits */
2166         intstatus = atomic_xchg(&bus->intstatus, 0);
2167
2168         /* Handle flow-control change: read new state in case our ack
2169          * crossed another change interrupt.  If change still set, assume
2170          * FC ON for safety, let next loop through do the debounce.
2171          */
2172         if (intstatus & I_HMB_FC_CHANGE) {
2173                 intstatus &= ~I_HMB_FC_CHANGE;
2174                 err = w_sdreg32(bus, I_HMB_FC_CHANGE,
2175                                 offsetof(struct sdpcmd_regs, intstatus));
2176
2177                 err = r_sdreg32(bus, &newstatus,
2178                                 offsetof(struct sdpcmd_regs, intstatus));
2179                 bus->sdcnt.f1regdata += 2;
2180                 atomic_set(&bus->fcstate,
2181                            !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE)));
2182                 intstatus |= (newstatus & bus->hostintmask);
2183         }
2184
2185         /* Handle host mailbox indication */
2186         if (intstatus & I_HMB_HOST_INT) {
2187                 intstatus &= ~I_HMB_HOST_INT;
2188                 intstatus |= brcmf_sdbrcm_hostmail(bus);
2189         }
2190
2191         sdio_release_host(bus->sdiodev->func[1]);
2192
2193         /* Generally don't ask for these, can get CRC errors... */
2194         if (intstatus & I_WR_OOSYNC) {
2195                 brcmf_err("Dongle reports WR_OOSYNC\n");
2196                 intstatus &= ~I_WR_OOSYNC;
2197         }
2198
2199         if (intstatus & I_RD_OOSYNC) {
2200                 brcmf_err("Dongle reports RD_OOSYNC\n");
2201                 intstatus &= ~I_RD_OOSYNC;
2202         }
2203
2204         if (intstatus & I_SBINT) {
2205                 brcmf_err("Dongle reports SBINT\n");
2206                 intstatus &= ~I_SBINT;
2207         }
2208
2209         /* Would be active due to wake-wlan in gSPI */
2210         if (intstatus & I_CHIPACTIVE) {
2211                 brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
2212                 intstatus &= ~I_CHIPACTIVE;
2213         }
2214
2215         /* Ignore frame indications if rxskip is set */
2216         if (bus->rxskip)
2217                 intstatus &= ~I_HMB_FRAME_IND;
2218
2219         /* On frame indication, read available frames */
2220         if (PKT_AVAILABLE() && bus->clkstate == CLK_AVAIL) {
2221                 framecnt = brcmf_sdio_readframes(bus, rxlimit);
2222                 if (!bus->rxpending)
2223                         intstatus &= ~I_HMB_FRAME_IND;
2224                 rxlimit -= min(framecnt, rxlimit);
2225         }
2226
2227         /* Keep still-pending events for next scheduling */
2228         if (intstatus) {
2229                 for_each_set_bit(n, &intstatus, 32)
2230                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
2231         }
2232
2233         brcmf_sdbrcm_clrintr(bus);
2234
2235         if (data_ok(bus) && bus->ctrl_frame_stat &&
2236                 (bus->clkstate == CLK_AVAIL)) {
2237                 int i;
2238
2239                 sdio_claim_host(bus->sdiodev->func[1]);
2240                 err = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2241                         SDIO_FUNC_2, F2SYNC, bus->ctrl_frame_buf,
2242                         (u32) bus->ctrl_frame_len);
2243
2244                 if (err < 0) {
2245                         /* On failure, abort the command and
2246                                 terminate the frame */
2247                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2248                                   err);
2249                         bus->sdcnt.tx_sderrs++;
2250
2251                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2252
2253                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2254                                          SFC_WF_TERM, &err);
2255                         bus->sdcnt.f1regdata++;
2256
2257                         for (i = 0; i < 3; i++) {
2258                                 u8 hi, lo;
2259                                 hi = brcmf_sdio_regrb(bus->sdiodev,
2260                                                       SBSDIO_FUNC1_WFRAMEBCHI,
2261                                                       &err);
2262                                 lo = brcmf_sdio_regrb(bus->sdiodev,
2263                                                       SBSDIO_FUNC1_WFRAMEBCLO,
2264                                                       &err);
2265                                 bus->sdcnt.f1regdata += 2;
2266                                 if ((hi == 0) && (lo == 0))
2267                                         break;
2268                         }
2269
2270                 } else {
2271                         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2272                 }
2273                 sdio_release_host(bus->sdiodev->func[1]);
2274                 bus->ctrl_frame_stat = false;
2275                 brcmf_sdbrcm_wait_event_wakeup(bus);
2276         }
2277         /* Send queued frames (limit 1 if rx may still be pending) */
2278         else if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
2279                  brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
2280                  && data_ok(bus)) {
2281                 framecnt = bus->rxpending ? min(txlimit, bus->txminmax) :
2282                                             txlimit;
2283                 framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
2284                 txlimit -= framecnt;
2285         }
2286
2287         if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) || (err != 0)) {
2288                 brcmf_err("failed backplane access over SDIO, halting operation\n");
2289                 bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
2290                 atomic_set(&bus->intstatus, 0);
2291         } else if (atomic_read(&bus->intstatus) ||
2292                    atomic_read(&bus->ipend) > 0 ||
2293                    (!atomic_read(&bus->fcstate) &&
2294                     brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
2295                     data_ok(bus)) || PKT_AVAILABLE()) {
2296                 brcmf_sdbrcm_adddpctsk(bus);
2297         }
2298
2299         /* If we're done for now, turn off clock request. */
2300         if ((bus->clkstate != CLK_PENDING)
2301             && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
2302                 bus->activity = false;
2303                 sdio_claim_host(bus->sdiodev->func[1]);
2304                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
2305                 sdio_release_host(bus->sdiodev->func[1]);
2306         }
2307 }
2308
2309 static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
2310 {
2311         int ret = -EBADE;
2312         uint datalen, prec;
2313         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2314         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2315         struct brcmf_sdio *bus = sdiodev->bus;
2316         unsigned long flags;
2317
2318         brcmf_dbg(TRACE, "Enter\n");
2319
2320         datalen = pkt->len;
2321
2322         /* Add space for the header */
2323         skb_push(pkt, SDPCM_HDRLEN);
2324         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
2325
2326         prec = prio2prec((pkt->priority & PRIOMASK));
2327
2328         /* Check for existing queue, current flow-control,
2329                          pending event, or pending clock */
2330         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
2331         bus->sdcnt.fcqueued++;
2332
2333         /* Priority based enq */
2334         spin_lock_bh(&bus->txqlock);
2335         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
2336                 skb_pull(pkt, SDPCM_HDRLEN);
2337                 brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
2338                 brcmf_err("out of bus->txq !!!\n");
2339                 ret = -ENOSR;
2340         } else {
2341                 ret = 0;
2342         }
2343         spin_unlock_bh(&bus->txqlock);
2344
2345         if (pktq_len(&bus->txq) >= TXHI) {
2346                 bus->txoff = true;
2347                 brcmf_txflowblock(bus->sdiodev->dev, true);
2348         }
2349
2350 #ifdef DEBUG
2351         if (pktq_plen(&bus->txq, prec) > qcount[prec])
2352                 qcount[prec] = pktq_plen(&bus->txq, prec);
2353 #endif
2354
2355         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
2356         if (list_empty(&bus->dpc_tsklst)) {
2357                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2358
2359                 brcmf_sdbrcm_adddpctsk(bus);
2360                 queue_work(bus->brcmf_wq, &bus->datawork);
2361         } else {
2362                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2363         }
2364
2365         return ret;
2366 }
2367
2368 static int
2369 brcmf_sdbrcm_membytes(struct brcmf_sdio *bus, bool write, u32 address, u8 *data,
2370                  uint size)
2371 {
2372         int bcmerror = 0;
2373         u32 sdaddr;
2374         uint dsize;
2375
2376         /* Determine initial transfer parameters */
2377         sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
2378         if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
2379                 dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
2380         else
2381                 dsize = size;
2382
2383         sdio_claim_host(bus->sdiodev->func[1]);
2384
2385         /* Set the backplane window to include the start address */
2386         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
2387         if (bcmerror) {
2388                 brcmf_err("window change failed\n");
2389                 goto xfer_done;
2390         }
2391
2392         /* Do the transfer(s) */
2393         while (size) {
2394                 brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
2395                           write ? "write" : "read", dsize,
2396                           sdaddr, address & SBSDIO_SBWINDOW_MASK);
2397                 bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
2398                                                sdaddr, data, dsize);
2399                 if (bcmerror) {
2400                         brcmf_err("membytes transfer failed\n");
2401                         break;
2402                 }
2403
2404                 /* Adjust for next transfer (if any) */
2405                 size -= dsize;
2406                 if (size) {
2407                         data += dsize;
2408                         address += dsize;
2409                         bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
2410                                                                   address);
2411                         if (bcmerror) {
2412                                 brcmf_err("window change failed\n");
2413                                 break;
2414                         }
2415                         sdaddr = 0;
2416                         dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
2417                 }
2418         }
2419
2420 xfer_done:
2421         /* Return the window to backplane enumeration space for core access */
2422         if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
2423                 brcmf_err("FAILED to set window back to 0x%x\n",
2424                           bus->sdiodev->sbwad);
2425
2426         sdio_release_host(bus->sdiodev->func[1]);
2427
2428         return bcmerror;
2429 }
2430
2431 #ifdef DEBUG
2432 #define CONSOLE_LINE_MAX        192
2433
2434 static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
2435 {
2436         struct brcmf_console *c = &bus->console;
2437         u8 line[CONSOLE_LINE_MAX], ch;
2438         u32 n, idx, addr;
2439         int rv;
2440
2441         /* Don't do anything until FWREADY updates console address */
2442         if (bus->console_addr == 0)
2443                 return 0;
2444
2445         /* Read console log struct */
2446         addr = bus->console_addr + offsetof(struct rte_console, log_le);
2447         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
2448                                    sizeof(c->log_le));
2449         if (rv < 0)
2450                 return rv;
2451
2452         /* Allocate console buffer (one time only) */
2453         if (c->buf == NULL) {
2454                 c->bufsize = le32_to_cpu(c->log_le.buf_size);
2455                 c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
2456                 if (c->buf == NULL)
2457                         return -ENOMEM;
2458         }
2459
2460         idx = le32_to_cpu(c->log_le.idx);
2461
2462         /* Protect against corrupt value */
2463         if (idx > c->bufsize)
2464                 return -EBADE;
2465
2466         /* Skip reading the console buffer if the index pointer
2467          has not moved */
2468         if (idx == c->last)
2469                 return 0;
2470
2471         /* Read the console buffer */
2472         addr = le32_to_cpu(c->log_le.buf);
2473         rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
2474         if (rv < 0)
2475                 return rv;
2476
2477         while (c->last != idx) {
2478                 for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
2479                         if (c->last == idx) {
2480                                 /* This would output a partial line.
2481                                  * Instead, back up
2482                                  * the buffer pointer and output this
2483                                  * line next time around.
2484                                  */
2485                                 if (c->last >= n)
2486                                         c->last -= n;
2487                                 else
2488                                         c->last = c->bufsize - n;
2489                                 goto break2;
2490                         }
2491                         ch = c->buf[c->last];
2492                         c->last = (c->last + 1) % c->bufsize;
2493                         if (ch == '\n')
2494                                 break;
2495                         line[n] = ch;
2496                 }
2497
2498                 if (n > 0) {
2499                         if (line[n - 1] == '\r')
2500                                 n--;
2501                         line[n] = 0;
2502                         pr_debug("CONSOLE: %s\n", line);
2503                 }
2504         }
2505 break2:
2506
2507         return 0;
2508 }
2509 #endif                          /* DEBUG */
2510
2511 static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
2512 {
2513         int i;
2514         int ret;
2515
2516         bus->ctrl_frame_stat = false;
2517         ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
2518                                     SDIO_FUNC_2, F2SYNC, frame, len);
2519
2520         if (ret < 0) {
2521                 /* On failure, abort the command and terminate the frame */
2522                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
2523                           ret);
2524                 bus->sdcnt.tx_sderrs++;
2525
2526                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
2527
2528                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
2529                                  SFC_WF_TERM, NULL);
2530                 bus->sdcnt.f1regdata++;
2531
2532                 for (i = 0; i < 3; i++) {
2533                         u8 hi, lo;
2534                         hi = brcmf_sdio_regrb(bus->sdiodev,
2535                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
2536                         lo = brcmf_sdio_regrb(bus->sdiodev,
2537                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
2538                         bus->sdcnt.f1regdata += 2;
2539                         if (hi == 0 && lo == 0)
2540                                 break;
2541                 }
2542                 return ret;
2543         }
2544
2545         bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
2546
2547         return ret;
2548 }
2549
2550 static int
2551 brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
2552 {
2553         u8 *frame;
2554         u16 len;
2555         u32 swheader;
2556         uint retries = 0;
2557         u8 doff = 0;
2558         int ret = -1;
2559         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2560         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2561         struct brcmf_sdio *bus = sdiodev->bus;
2562         unsigned long flags;
2563
2564         brcmf_dbg(TRACE, "Enter\n");
2565
2566         /* Back the pointer to make a room for bus header */
2567         frame = msg - SDPCM_HDRLEN;
2568         len = (msglen += SDPCM_HDRLEN);
2569
2570         /* Add alignment padding (optional for ctl frames) */
2571         doff = ((unsigned long)frame % BRCMF_SDALIGN);
2572         if (doff) {
2573                 frame -= doff;
2574                 len += doff;
2575                 msglen += doff;
2576                 memset(frame, 0, doff + SDPCM_HDRLEN);
2577         }
2578         /* precondition: doff < BRCMF_SDALIGN */
2579         doff += SDPCM_HDRLEN;
2580
2581         /* Round send length to next SDIO block */
2582         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
2583                 u16 pad = bus->blocksize - (len % bus->blocksize);
2584                 if ((pad <= bus->roundup) && (pad < bus->blocksize))
2585                         len += pad;
2586         } else if (len % BRCMF_SDALIGN) {
2587                 len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
2588         }
2589
2590         /* Satisfy length-alignment requirements */
2591         if (len & (ALIGNMENT - 1))
2592                 len = roundup(len, ALIGNMENT);
2593
2594         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
2595
2596         /* Make sure backplane clock is on */
2597         sdio_claim_host(bus->sdiodev->func[1]);
2598         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2599         sdio_release_host(bus->sdiodev->func[1]);
2600
2601         /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
2602         *(__le16 *) frame = cpu_to_le16((u16) msglen);
2603         *(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
2604
2605         /* Software tag: channel, sequence number, data offset */
2606         swheader =
2607             ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
2608              SDPCM_CHANNEL_MASK)
2609             | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
2610                              SDPCM_DOFFSET_MASK);
2611         put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
2612         put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
2613
2614         if (!data_ok(bus)) {
2615                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
2616                           bus->tx_max, bus->tx_seq);
2617                 bus->ctrl_frame_stat = true;
2618                 /* Send from dpc */
2619                 bus->ctrl_frame_buf = frame;
2620                 bus->ctrl_frame_len = len;
2621
2622                 wait_event_interruptible_timeout(bus->ctrl_wait,
2623                                                  !bus->ctrl_frame_stat,
2624                                                  msecs_to_jiffies(2000));
2625
2626                 if (!bus->ctrl_frame_stat) {
2627                         brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
2628                         ret = 0;
2629                 } else {
2630                         brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
2631                         ret = -1;
2632                 }
2633         }
2634
2635         if (ret == -1) {
2636                 brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
2637                                    frame, len, "Tx Frame:\n");
2638                 brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
2639                                    BRCMF_HDRS_ON(),
2640                                    frame, min_t(u16, len, 16), "TxHdr:\n");
2641
2642                 do {
2643                         sdio_claim_host(bus->sdiodev->func[1]);
2644                         ret = brcmf_tx_frame(bus, frame, len);
2645                         sdio_release_host(bus->sdiodev->func[1]);
2646                 } while (ret < 0 && retries++ < TXRETRIES);
2647         }
2648
2649         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
2650         if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) &&
2651             list_empty(&bus->dpc_tsklst)) {
2652                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2653
2654                 bus->activity = false;
2655                 sdio_claim_host(bus->sdiodev->func[1]);
2656                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
2657                 sdio_release_host(bus->sdiodev->func[1]);
2658         } else {
2659                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
2660         }
2661
2662         if (ret)
2663                 bus->sdcnt.tx_ctlerrs++;
2664         else
2665                 bus->sdcnt.tx_ctlpkts++;
2666
2667         return ret ? -EIO : 0;
2668 }
2669
2670 #ifdef DEBUG
2671 static inline bool brcmf_sdio_valid_shared_address(u32 addr)
2672 {
2673         return !(addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff));
2674 }
2675
2676 static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
2677                                  struct sdpcm_shared *sh)
2678 {
2679         u32 addr;
2680         int rv;
2681         u32 shaddr = 0;
2682         struct sdpcm_shared_le sh_le;
2683         __le32 addr_le;
2684
2685         shaddr = bus->ramsize - 4;
2686
2687         /*
2688          * Read last word in socram to determine
2689          * address of sdpcm_shared structure
2690          */
2691         sdio_claim_host(bus->sdiodev->func[1]);
2692         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
2693         rv = brcmf_sdbrcm_membytes(bus, false, shaddr,
2694                                    (u8 *)&addr_le, 4);
2695         sdio_release_host(bus->sdiodev->func[1]);
2696         if (rv < 0)
2697                 return rv;
2698
2699         addr = le32_to_cpu(addr_le);
2700
2701         brcmf_dbg(INFO, "sdpcm_shared address 0x%08X\n", addr);
2702
2703         /*
2704          * Check if addr is valid.
2705          * NVRAM length at the end of memory should have been overwritten.
2706          */
2707         if (!brcmf_sdio_valid_shared_address(addr)) {
2708                         brcmf_err("invalid sdpcm_shared address 0x%08X\n",
2709                                   addr);
2710                         return -EINVAL;
2711         }
2712
2713         /* Read hndrte_shared structure */
2714         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&sh_le,
2715                                    sizeof(struct sdpcm_shared_le));
2716         if (rv < 0)
2717                 return rv;
2718
2719         /* Endianness */
2720         sh->flags = le32_to_cpu(sh_le.flags);
2721         sh->trap_addr = le32_to_cpu(sh_le.trap_addr);
2722         sh->assert_exp_addr = le32_to_cpu(sh_le.assert_exp_addr);
2723         sh->assert_file_addr = le32_to_cpu(sh_le.assert_file_addr);
2724         sh->assert_line = le32_to_cpu(sh_le.assert_line);
2725         sh->console_addr = le32_to_cpu(sh_le.console_addr);
2726         sh->msgtrace_addr = le32_to_cpu(sh_le.msgtrace_addr);
2727
2728         if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
2729                 brcmf_err("sdpcm_shared version mismatch: dhd %d dongle %d\n",
2730                           SDPCM_SHARED_VERSION,
2731                           sh->flags & SDPCM_SHARED_VERSION_MASK);
2732                 return -EPROTO;
2733         }
2734
2735         return 0;
2736 }
2737
2738 static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
2739                                    struct sdpcm_shared *sh, char __user *data,
2740                                    size_t count)
2741 {
2742         u32 addr, console_ptr, console_size, console_index;
2743         char *conbuf = NULL;
2744         __le32 sh_val;
2745         int rv;
2746         loff_t pos = 0;
2747         int nbytes = 0;
2748
2749         /* obtain console information from device memory */
2750         addr = sh->console_addr + offsetof(struct rte_console, log_le);
2751         rv = brcmf_sdbrcm_membytes(bus, false, addr,
2752                         (u8 *)&sh_val, sizeof(u32));
2753         if (rv < 0)
2754                 return rv;
2755         console_ptr = le32_to_cpu(sh_val);
2756
2757         addr = sh->console_addr + offsetof(struct rte_console, log_le.buf_size);
2758         rv = brcmf_sdbrcm_membytes(bus, false, addr,
2759                         (u8 *)&sh_val, sizeof(u32));
2760         if (rv < 0)
2761                 return rv;
2762         console_size = le32_to_cpu(sh_val);
2763
2764         addr = sh->console_addr + offsetof(struct rte_console, log_le.idx);
2765         rv = brcmf_sdbrcm_membytes(bus, false, addr,
2766                         (u8 *)&sh_val, sizeof(u32));
2767         if (rv < 0)
2768                 return rv;
2769         console_index = le32_to_cpu(sh_val);
2770
2771         /* allocate buffer for console data */
2772         if (console_size <= CONSOLE_BUFFER_MAX)
2773                 conbuf = vzalloc(console_size+1);
2774
2775         if (!conbuf)
2776                 return -ENOMEM;
2777
2778         /* obtain the console data from device */
2779         conbuf[console_size] = '\0';
2780         rv = brcmf_sdbrcm_membytes(bus, false, console_ptr, (u8 *)conbuf,
2781                                    console_size);
2782         if (rv < 0)
2783                 goto done;
2784
2785         rv = simple_read_from_buffer(data, count, &pos,
2786                                      conbuf + console_index,
2787                                      console_size - console_index);
2788         if (rv < 0)
2789                 goto done;
2790
2791         nbytes = rv;
2792         if (console_index > 0) {
2793                 pos = 0;
2794                 rv = simple_read_from_buffer(data+nbytes, count, &pos,
2795                                              conbuf, console_index - 1);
2796                 if (rv < 0)
2797                         goto done;
2798                 rv += nbytes;
2799         }
2800 done:
2801         vfree(conbuf);
2802         return rv;
2803 }
2804
2805 static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
2806                                 char __user *data, size_t count)
2807 {
2808         int error, res;
2809         char buf[350];
2810         struct brcmf_trap_info tr;
2811         int nbytes;
2812         loff_t pos = 0;
2813
2814         if ((sh->flags & SDPCM_SHARED_TRAP) == 0)
2815                 return 0;
2816
2817         error = brcmf_sdbrcm_membytes(bus, false, sh->trap_addr, (u8 *)&tr,
2818                                       sizeof(struct brcmf_trap_info));
2819         if (error < 0)
2820                 return error;
2821
2822         nbytes = brcmf_sdio_dump_console(bus, sh, data, count);
2823         if (nbytes < 0)
2824                 return nbytes;
2825
2826         res = scnprintf(buf, sizeof(buf),
2827                         "dongle trap info: type 0x%x @ epc 0x%08x\n"
2828                         "  cpsr 0x%08x spsr 0x%08x sp 0x%08x\n"
2829                         "  lr   0x%08x pc   0x%08x offset 0x%x\n"
2830                         "  r0   0x%08x r1   0x%08x r2 0x%08x r3 0x%08x\n"
2831                         "  r4   0x%08x r5   0x%08x r6 0x%08x r7 0x%08x\n",
2832                         le32_to_cpu(tr.type), le32_to_cpu(tr.epc),
2833                         le32_to_cpu(tr.cpsr), le32_to_cpu(tr.spsr),
2834                         le32_to_cpu(tr.r13), le32_to_cpu(tr.r14),
2835                         le32_to_cpu(tr.pc), sh->trap_addr,
2836                         le32_to_cpu(tr.r0), le32_to_cpu(tr.r1),
2837                         le32_to_cpu(tr.r2), le32_to_cpu(tr.r3),
2838                         le32_to_cpu(tr.r4), le32_to_cpu(tr.r5),
2839                         le32_to_cpu(tr.r6), le32_to_cpu(tr.r7));
2840
2841         error = simple_read_from_buffer(data+nbytes, count, &pos, buf, res);
2842         if (error < 0)
2843                 return error;
2844
2845         nbytes += error;
2846         return nbytes;
2847 }
2848
2849 static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
2850                                   struct sdpcm_shared *sh, char __user *data,
2851                                   size_t count)
2852 {
2853         int error = 0;
2854         char buf[200];
2855         char file[80] = "?";
2856         char expr[80] = "<???>";
2857         int res;
2858         loff_t pos = 0;
2859
2860         if ((sh->flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
2861                 brcmf_dbg(INFO, "firmware not built with -assert\n");
2862                 return 0;
2863         } else if ((sh->flags & SDPCM_SHARED_ASSERT) == 0) {
2864                 brcmf_dbg(INFO, "no assert in dongle\n");
2865                 return 0;
2866         }
2867
2868         sdio_claim_host(bus->sdiodev->func[1]);
2869         if (sh->assert_file_addr != 0) {
2870                 error = brcmf_sdbrcm_membytes(bus, false, sh->assert_file_addr,
2871                                               (u8 *)file, 80);
2872                 if (error < 0)
2873                         return error;
2874         }
2875         if (sh->assert_exp_addr != 0) {
2876                 error = brcmf_sdbrcm_membytes(bus, false, sh->assert_exp_addr,
2877                                               (u8 *)expr, 80);
2878                 if (error < 0)
2879                         return error;
2880         }
2881         sdio_release_host(bus->sdiodev->func[1]);
2882
2883         res = scnprintf(buf, sizeof(buf),
2884                         "dongle assert: %s:%d: assert(%s)\n",
2885                         file, sh->assert_line, expr);
2886         return simple_read_from_buffer(data, count, &pos, buf, res);
2887 }
2888
2889 static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
2890 {
2891         int error;
2892         struct sdpcm_shared sh;
2893
2894         error = brcmf_sdio_readshared(bus, &sh);
2895
2896         if (error < 0)
2897                 return error;
2898
2899         if ((sh.flags & SDPCM_SHARED_ASSERT_BUILT) == 0)
2900                 brcmf_dbg(INFO, "firmware not built with -assert\n");
2901         else if (sh.flags & SDPCM_SHARED_ASSERT)
2902                 brcmf_err("assertion in dongle\n");
2903
2904         if (sh.flags & SDPCM_SHARED_TRAP)
2905                 brcmf_err("firmware trap in dongle\n");
2906
2907         return 0;
2908 }
2909
2910 static int brcmf_sdbrcm_died_dump(struct brcmf_sdio *bus, char __user *data,
2911                                   size_t count, loff_t *ppos)
2912 {
2913         int error = 0;
2914         struct sdpcm_shared sh;
2915         int nbytes = 0;
2916         loff_t pos = *ppos;
2917
2918         if (pos != 0)
2919                 return 0;
2920
2921         error = brcmf_sdio_readshared(bus, &sh);
2922         if (error < 0)
2923                 goto done;
2924
2925         error = brcmf_sdio_assert_info(bus, &sh, data, count);
2926         if (error < 0)
2927                 goto done;
2928
2929         nbytes = error;
2930         error = brcmf_sdio_trap_info(bus, &sh, data, count);
2931         if (error < 0)
2932                 goto done;
2933
2934         error += nbytes;
2935         *ppos += error;
2936 done:
2937         return error;
2938 }
2939
2940 static ssize_t brcmf_sdio_forensic_read(struct file *f, char __user *data,
2941                                         size_t count, loff_t *ppos)
2942 {
2943         struct brcmf_sdio *bus = f->private_data;
2944         int res;
2945
2946         res = brcmf_sdbrcm_died_dump(bus, data, count, ppos);
2947         if (res > 0)
2948                 *ppos += res;
2949         return (ssize_t)res;
2950 }
2951
2952 static const struct file_operations brcmf_sdio_forensic_ops = {
2953         .owner = THIS_MODULE,
2954         .open = simple_open,
2955         .read = brcmf_sdio_forensic_read
2956 };
2957
2958 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
2959 {
2960         struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
2961         struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
2962
2963         if (IS_ERR_OR_NULL(dentry))
2964                 return;
2965
2966         debugfs_create_file("forensics", S_IRUGO, dentry, bus,
2967                             &brcmf_sdio_forensic_ops);
2968         brcmf_debugfs_create_sdio_count(drvr, &bus->sdcnt);
2969 }
2970 #else
2971 static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
2972 {
2973         return 0;
2974 }
2975
2976 static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
2977 {
2978 }
2979 #endif /* DEBUG */
2980
2981 static int
2982 brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
2983 {
2984         int timeleft;
2985         uint rxlen = 0;
2986         bool pending;
2987         u8 *buf;
2988         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
2989         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
2990         struct brcmf_sdio *bus = sdiodev->bus;
2991
2992         brcmf_dbg(TRACE, "Enter\n");
2993
2994         /* Wait until control frame is available */
2995         timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
2996
2997         spin_lock_bh(&bus->rxctl_lock);
2998         rxlen = bus->rxlen;
2999         memcpy(msg, bus->rxctl, min(msglen, rxlen));
3000         bus->rxctl = NULL;
3001         buf = bus->rxctl_orig;
3002         bus->rxctl_orig = NULL;
3003         bus->rxlen = 0;
3004         spin_unlock_bh(&bus->rxctl_lock);
3005         vfree(buf);
3006
3007         if (rxlen) {
3008                 brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
3009                           rxlen, msglen);
3010         } else if (timeleft == 0) {
3011                 brcmf_err("resumed on timeout\n");
3012                 brcmf_sdbrcm_checkdied(bus);
3013         } else if (pending) {
3014                 brcmf_dbg(CTL, "cancelled\n");
3015                 return -ERESTARTSYS;
3016         } else {
3017                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
3018                 brcmf_sdbrcm_checkdied(bus);
3019         }
3020
3021         if (rxlen)
3022                 bus->sdcnt.rx_ctlpkts++;
3023         else
3024                 bus->sdcnt.rx_ctlerrs++;
3025
3026         return rxlen ? (int)rxlen : -ETIMEDOUT;
3027 }
3028
3029 static int brcmf_sdbrcm_write_vars(struct brcmf_sdio *bus)
3030 {
3031         int bcmerror = 0;
3032         u32 varaddr;
3033         u32 varsizew;
3034         __le32 varsizew_le;
3035 #ifdef DEBUG
3036         char *nvram_ularray;
3037 #endif                          /* DEBUG */
3038
3039         /* Even if there are no vars are to be written, we still
3040                  need to set the ramsize. */
3041         varaddr = (bus->ramsize - 4) - bus->varsz;
3042
3043         if (bus->vars) {
3044                 /* Write the vars list */
3045                 bcmerror = brcmf_sdbrcm_membytes(bus, true, varaddr,
3046                                                  bus->vars, bus->varsz);
3047 #ifdef DEBUG
3048                 /* Verify NVRAM bytes */
3049                 brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n",
3050                           bus->varsz);
3051                 nvram_ularray = kmalloc(bus->varsz, GFP_ATOMIC);
3052                 if (!nvram_ularray)
3053                         return -ENOMEM;
3054
3055                 /* Upload image to verify downloaded contents. */
3056                 memset(nvram_ularray, 0xaa, bus->varsz);
3057
3058                 /* Read the vars list to temp buffer for comparison */
3059                 bcmerror = brcmf_sdbrcm_membytes(bus, false, varaddr,
3060                                                  nvram_ularray, bus->varsz);
3061                 if (bcmerror) {
3062                         brcmf_err("error %d on reading %d nvram bytes at 0x%08x\n",
3063                                   bcmerror, bus->varsz, varaddr);
3064                 }
3065                 /* Compare the org NVRAM with the one read from RAM */
3066                 if (memcmp(bus->vars, nvram_ularray, bus->varsz))
3067                         brcmf_err("Downloaded NVRAM image is corrupted\n");
3068                 else
3069                         brcmf_err("Download/Upload/Compare of NVRAM ok\n");
3070
3071                 kfree(nvram_ularray);
3072 #endif                          /* DEBUG */
3073         }
3074
3075         /* adjust to the user specified RAM */
3076         brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
3077         brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
3078                   varaddr, bus->varsz);
3079
3080         /*
3081          * Determine the length token:
3082          * Varsize, converted to words, in lower 16-bits, checksum
3083          * in upper 16-bits.
3084          */
3085         if (bcmerror) {
3086                 varsizew = 0;
3087                 varsizew_le = cpu_to_le32(0);
3088         } else {
3089                 varsizew = bus->varsz / 4;
3090                 varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
3091                 varsizew_le = cpu_to_le32(varsizew);
3092         }
3093
3094         brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
3095                   bus->varsz, varsizew);
3096
3097         /* Write the length token to the last word */
3098         bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
3099                                          (u8 *)&varsizew_le, 4);
3100
3101         return bcmerror;
3102 }
3103
3104 static int brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
3105 {
3106         int bcmerror = 0;
3107         struct chip_info *ci = bus->ci;
3108
3109         /* To enter download state, disable ARM and reset SOCRAM.
3110          * To exit download state, simply reset ARM (default is RAM boot).
3111          */
3112         if (enter) {
3113                 bus->alp_only = true;
3114
3115                 ci->coredisable(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3116
3117                 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM);
3118
3119                 /* Clear the top bit of memory */
3120                 if (bus->ramsize) {
3121                         u32 zeros = 0;
3122                         brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
3123                                          (u8 *)&zeros, 4);
3124                 }
3125         } else {
3126                 if (!ci->iscoreup(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
3127                         brcmf_err("SOCRAM core is down after reset?\n");
3128                         bcmerror = -EBADE;
3129                         goto fail;
3130                 }
3131
3132                 bcmerror = brcmf_sdbrcm_write_vars(bus);
3133                 if (bcmerror) {
3134                         brcmf_err("no vars written to RAM\n");
3135                         bcmerror = 0;
3136                 }
3137
3138                 w_sdreg32(bus, 0xFFFFFFFF,
3139                           offsetof(struct sdpcmd_regs, intstatus));
3140
3141                 ci->resetcore(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
3142
3143                 /* Allow HT Clock now that the ARM is running. */
3144                 bus->alp_only = false;
3145
3146                 bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
3147         }
3148 fail:
3149         return bcmerror;
3150 }
3151
3152 static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
3153 {
3154         if (bus->firmware->size < bus->fw_ptr + len)
3155                 len = bus->firmware->size - bus->fw_ptr;
3156
3157         memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
3158         bus->fw_ptr += len;
3159         return len;
3160 }
3161
3162 static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
3163 {
3164         int offset = 0;
3165         uint len;
3166         u8 *memblock = NULL, *memptr;
3167         int ret;
3168
3169         brcmf_dbg(INFO, "Enter\n");
3170
3171         ret = request_firmware(&bus->firmware, BRCMF_SDIO_FW_NAME,
3172                                &bus->sdiodev->func[2]->dev);
3173         if (ret) {
3174                 brcmf_err("Fail to request firmware %d\n", ret);
3175                 return ret;
3176         }
3177         bus->fw_ptr = 0;
3178
3179         memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
3180         if (memblock == NULL) {
3181                 ret = -ENOMEM;
3182                 goto err;
3183         }
3184         if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
3185                 memptr += (BRCMF_SDALIGN -
3186                            ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
3187
3188         /* Download image */
3189         while ((len =
3190                 brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
3191                 ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
3192                 if (ret) {
3193                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
3194                                   ret, MEMBLOCK, offset);
3195                         goto err;
3196                 }
3197
3198                 offset += MEMBLOCK;
3199         }
3200
3201 err:
3202         kfree(memblock);
3203
3204         release_firmware(bus->firmware);
3205         bus->fw_ptr = 0;
3206
3207         return ret;
3208 }
3209
3210 /*
3211  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
3212  * and ending in a NUL.
3213  * Removes carriage returns, empty lines, comment lines, and converts
3214  * newlines to NULs.
3215  * Shortens buffer as needed and pads with NULs.  End of buffer is marked
3216  * by two NULs.
3217 */
3218
3219 static int brcmf_process_nvram_vars(struct brcmf_sdio *bus)
3220 {
3221         char *varbuf;
3222         char *dp;
3223         bool findNewline;
3224         int column;
3225         int ret = 0;
3226         uint buf_len, n, len;
3227
3228         len = bus->firmware->size;
3229         varbuf = vmalloc(len);
3230         if (!varbuf)
3231                 return -ENOMEM;
3232
3233         memcpy(varbuf, bus->firmware->data, len);
3234         dp = varbuf;
3235
3236         findNewline = false;
3237         column = 0;
3238
3239         for (n = 0; n < len; n++) {
3240                 if (varbuf[n] == 0)
3241                         break;
3242                 if (varbuf[n] == '\r')
3243                         continue;
3244                 if (findNewline && varbuf[n] != '\n')
3245                         continue;
3246                 findNewline = false;
3247                 if (varbuf[n] == '#') {
3248                         findNewline = true;
3249                         continue;
3250                 }
3251                 if (varbuf[n] == '\n') {
3252                         if (column == 0)
3253                                 continue;
3254                         *dp++ = 0;
3255                         column = 0;
3256                         continue;
3257                 }
3258                 *dp++ = varbuf[n];
3259                 column++;
3260         }
3261         buf_len = dp - varbuf;
3262         while (dp < varbuf + n)
3263                 *dp++ = 0;
3264
3265         kfree(bus->vars);
3266         /* roundup needed for download to device */
3267         bus->varsz = roundup(buf_len + 1, 4);
3268         bus->vars = kmalloc(bus->varsz, GFP_KERNEL);
3269         if (bus->vars == NULL) {
3270                 bus->varsz = 0;
3271                 ret = -ENOMEM;
3272                 goto err;
3273         }
3274
3275         /* copy the processed variables and add null termination */
3276         memcpy(bus->vars, varbuf, buf_len);
3277         bus->vars[buf_len] = 0;
3278 err:
3279         vfree(varbuf);
3280         return ret;
3281 }
3282
3283 static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
3284 {
3285         int ret;
3286
3287         ret = request_firmware(&bus->firmware, BRCMF_SDIO_NV_NAME,
3288                                &bus->sdiodev->func[2]->dev);
3289         if (ret) {
3290                 brcmf_err("Fail to request nvram %d\n", ret);
3291                 return ret;
3292         }
3293
3294         ret = brcmf_process_nvram_vars(bus);
3295
3296         release_firmware(bus->firmware);
3297
3298         return ret;
3299 }
3300
3301 static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3302 {
3303         int bcmerror = -1;
3304
3305         /* Keep arm in reset */
3306         if (brcmf_sdbrcm_download_state(bus, true)) {
3307                 brcmf_err("error placing ARM core in reset\n");
3308                 goto err;
3309         }
3310
3311         /* External image takes precedence if specified */
3312         if (brcmf_sdbrcm_download_code_file(bus)) {
3313                 brcmf_err("dongle image file download failed\n");
3314                 goto err;
3315         }
3316
3317         /* External nvram takes precedence if specified */
3318         if (brcmf_sdbrcm_download_nvram(bus))
3319                 brcmf_err("dongle nvram file download failed\n");
3320
3321         /* Take arm out of reset */
3322         if (brcmf_sdbrcm_download_state(bus, false)) {
3323                 brcmf_err("error getting out of ARM core reset\n");
3324                 goto err;
3325         }
3326
3327         bcmerror = 0;
3328
3329 err:
3330         return bcmerror;
3331 }
3332
3333 static bool
3334 brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
3335 {
3336         bool ret;
3337
3338         sdio_claim_host(bus->sdiodev->func[1]);
3339
3340         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3341
3342         ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
3343
3344         brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
3345
3346         sdio_release_host(bus->sdiodev->func[1]);
3347
3348         return ret;
3349 }
3350
3351 static int brcmf_sdbrcm_bus_init(struct device *dev)
3352 {
3353         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
3354         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
3355         struct brcmf_sdio *bus = sdiodev->bus;
3356         unsigned long timeout;
3357         u8 ready, enable;
3358         int err, ret = 0;
3359         u8 saveclk;
3360
3361         brcmf_dbg(TRACE, "Enter\n");
3362
3363         /* try to download image and nvram to the dongle */
3364         if (bus_if->state == BRCMF_BUS_DOWN) {
3365                 if (!(brcmf_sdbrcm_download_firmware(bus)))
3366                         return -1;
3367         }
3368
3369         if (!bus->sdiodev->bus_if->drvr)
3370                 return 0;
3371
3372         /* Start the watchdog timer */
3373         bus->sdcnt.tickcnt = 0;
3374         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3375
3376         sdio_claim_host(bus->sdiodev->func[1]);
3377
3378         /* Make sure backplane clock is on, needed to generate F2 interrupt */
3379         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3380         if (bus->clkstate != CLK_AVAIL)
3381                 goto exit;
3382
3383         /* Force clocks on backplane to be sure F2 interrupt propagates */
3384         saveclk = brcmf_sdio_regrb(bus->sdiodev,
3385                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
3386         if (!err) {
3387                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3388                                  (saveclk | SBSDIO_FORCE_HT), &err);
3389         }
3390         if (err) {
3391                 brcmf_err("Failed to force clock for F2: err %d\n", err);
3392                 goto exit;
3393         }
3394
3395         /* Enable function 2 (frame transfers) */
3396         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
3397                   offsetof(struct sdpcmd_regs, tosbmailboxdata));
3398         enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
3399
3400         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
3401
3402         timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
3403         ready = 0;
3404         while (enable != ready) {
3405                 ready = brcmf_sdio_regrb(bus->sdiodev,
3406                                          SDIO_CCCR_IORx, NULL);
3407                 if (time_after(jiffies, timeout))
3408                         break;
3409                 else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
3410                         /* prevent busy waiting if it takes too long */
3411                         msleep_interruptible(20);
3412         }
3413
3414         brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
3415
3416         /* If F2 successfully enabled, set core and enable interrupts */
3417         if (ready == enable) {
3418                 /* Set up the interrupt mask and enable interrupts */
3419                 bus->hostintmask = HOSTINTMASK;
3420                 w_sdreg32(bus, bus->hostintmask,
3421                           offsetof(struct sdpcmd_regs, hostintmask));
3422
3423                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
3424         } else {
3425                 /* Disable F2 again */
3426                 enable = SDIO_FUNC_ENABLE_1;
3427                 brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
3428                 ret = -ENODEV;
3429         }
3430
3431         /* Restore previous clock setting */
3432         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
3433
3434         if (ret == 0) {
3435                 ret = brcmf_sdio_intr_register(bus->sdiodev);
3436                 if (ret != 0)
3437                         brcmf_err("intr register failed:%d\n", ret);
3438         }
3439
3440         /* If we didn't come up, turn off backplane clock */
3441         if (bus_if->state != BRCMF_BUS_DATA)
3442                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3443
3444 exit:
3445         sdio_release_host(bus->sdiodev->func[1]);
3446
3447         return ret;
3448 }
3449
3450 void brcmf_sdbrcm_isr(void *arg)
3451 {
3452         struct brcmf_sdio *bus = (struct brcmf_sdio *) arg;
3453
3454         brcmf_dbg(TRACE, "Enter\n");
3455
3456         if (!bus) {
3457                 brcmf_err("bus is null pointer, exiting\n");
3458                 return;
3459         }
3460
3461         if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
3462                 brcmf_err("bus is down. we have nothing to do\n");
3463                 return;
3464         }
3465         /* Count the interrupt call */
3466         bus->sdcnt.intrcount++;
3467         if (in_interrupt())
3468                 atomic_set(&bus->ipend, 1);
3469         else
3470                 if (brcmf_sdio_intr_rstatus(bus)) {
3471                         brcmf_err("failed backplane access\n");
3472                         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
3473                 }
3474
3475         /* Disable additional interrupts (is this needed now)? */
3476         if (!bus->intr)
3477                 brcmf_err("isr w/o interrupt configured!\n");
3478
3479         brcmf_sdbrcm_adddpctsk(bus);
3480         queue_work(bus->brcmf_wq, &bus->datawork);
3481 }
3482
3483 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
3484 {
3485 #ifdef DEBUG
3486         struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
3487 #endif  /* DEBUG */
3488         unsigned long flags;
3489
3490         brcmf_dbg(TIMER, "Enter\n");
3491
3492         /* Poll period: check device if appropriate. */
3493         if (bus->poll && (++bus->polltick >= bus->pollrate)) {
3494                 u32 intstatus = 0;
3495
3496                 /* Reset poll tick */
3497                 bus->polltick = 0;
3498
3499                 /* Check device if no interrupts */
3500                 if (!bus->intr ||
3501                     (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
3502
3503                         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
3504                         if (list_empty(&bus->dpc_tsklst)) {
3505                                 u8 devpend;
3506                                 spin_unlock_irqrestore(&bus->dpc_tl_lock,
3507                                                        flags);
3508                                 sdio_claim_host(bus->sdiodev->func[1]);
3509                                 devpend = brcmf_sdio_regrb(bus->sdiodev,
3510                                                            SDIO_CCCR_INTx,
3511                                                            NULL);
3512                                 sdio_release_host(bus->sdiodev->func[1]);
3513                                 intstatus =
3514                                     devpend & (INTR_STATUS_FUNC1 |
3515                                                INTR_STATUS_FUNC2);
3516                         } else {
3517                                 spin_unlock_irqrestore(&bus->dpc_tl_lock,
3518                                                        flags);
3519                         }
3520
3521                         /* If there is something, make like the ISR and
3522                                  schedule the DPC */
3523                         if (intstatus) {
3524                                 bus->sdcnt.pollcnt++;
3525                                 atomic_set(&bus->ipend, 1);
3526
3527                                 brcmf_sdbrcm_adddpctsk(bus);
3528                                 queue_work(bus->brcmf_wq, &bus->datawork);
3529                         }
3530                 }
3531
3532                 /* Update interrupt tracking */
3533                 bus->sdcnt.lastintrs = bus->sdcnt.intrcount;
3534         }
3535 #ifdef DEBUG
3536         /* Poll for console output periodically */
3537         if (bus_if && bus_if->state == BRCMF_BUS_DATA &&
3538             bus->console_interval != 0) {
3539                 bus->console.count += BRCMF_WD_POLL_MS;
3540                 if (bus->console.count >= bus->console_interval) {
3541                         bus->console.count -= bus->console_interval;
3542                         sdio_claim_host(bus->sdiodev->func[1]);
3543                         /* Make sure backplane clock is on */
3544                         brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3545                         if (brcmf_sdbrcm_readconsole(bus) < 0)
3546                                 /* stop on error */
3547                                 bus->console_interval = 0;
3548                         sdio_release_host(bus->sdiodev->func[1]);
3549                 }
3550         }
3551 #endif                          /* DEBUG */
3552
3553         /* On idle timeout clear activity flag and/or turn off clock */
3554         if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
3555                 if (++bus->idlecount >= bus->idletime) {
3556                         bus->idlecount = 0;
3557                         if (bus->activity) {
3558                                 bus->activity = false;
3559                                 brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
3560                         } else {
3561                                 sdio_claim_host(bus->sdiodev->func[1]);
3562                                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3563                                 sdio_release_host(bus->sdiodev->func[1]);
3564                         }
3565                 }
3566         }
3567
3568         return (atomic_read(&bus->ipend) > 0);
3569 }
3570
3571 static bool brcmf_sdbrcm_chipmatch(u16 chipid)
3572 {
3573         if (chipid == BCM43241_CHIP_ID)
3574                 return true;
3575         if (chipid == BCM4329_CHIP_ID)
3576                 return true;
3577         if (chipid == BCM4330_CHIP_ID)
3578                 return true;
3579         if (chipid == BCM4334_CHIP_ID)
3580                 return true;
3581         return false;
3582 }
3583
3584 static void brcmf_sdio_dataworker(struct work_struct *work)
3585 {
3586         struct brcmf_sdio *bus = container_of(work, struct brcmf_sdio,
3587                                               datawork);
3588         struct list_head *cur_hd, *tmp_hd;
3589         unsigned long flags;
3590
3591         spin_lock_irqsave(&bus->dpc_tl_lock, flags);
3592         list_for_each_safe(cur_hd, tmp_hd, &bus->dpc_tsklst) {
3593                 spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
3594
3595                 brcmf_sdbrcm_dpc(bus);
3596
3597                 spin_lock_irqsave(&bus->dpc_tl_lock, flags);
3598                 list_del(cur_hd);
3599                 kfree(cur_hd);
3600         }
3601         spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
3602 }
3603
3604 static void brcmf_sdbrcm_release_malloc(struct brcmf_sdio *bus)
3605 {
3606         brcmf_dbg(TRACE, "Enter\n");
3607
3608         kfree(bus->rxbuf);
3609         bus->rxctl = bus->rxbuf = NULL;
3610         bus->rxlen = 0;
3611
3612         kfree(bus->databuf);
3613         bus->databuf = NULL;
3614 }
3615
3616 static bool brcmf_sdbrcm_probe_malloc(struct brcmf_sdio *bus)
3617 {
3618         brcmf_dbg(TRACE, "Enter\n");
3619
3620         if (bus->sdiodev->bus_if->maxctl) {
3621                 bus->rxblen =
3622                     roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
3623                             ALIGNMENT) + BRCMF_SDALIGN;
3624                 bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
3625                 if (!(bus->rxbuf))
3626                         goto fail;
3627         }
3628
3629         /* Allocate buffer to receive glomed packet */
3630         bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
3631         if (!(bus->databuf)) {
3632                 /* release rxbuf which was already located as above */
3633                 if (!bus->rxblen)
3634                         kfree(bus->rxbuf);
3635                 goto fail;
3636         }
3637
3638         /* Align the buffer */
3639         if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
3640                 bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
3641                                ((unsigned long)bus->databuf % BRCMF_SDALIGN));
3642         else
3643                 bus->dataptr = bus->databuf;
3644
3645         return true;
3646
3647 fail:
3648         return false;
3649 }
3650
3651 static bool
3652 brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
3653 {
3654         u8 clkctl = 0;
3655         int err = 0;
3656         int reg_addr;
3657         u32 reg_val;
3658         u8 idx;
3659
3660         bus->alp_only = true;
3661
3662         sdio_claim_host(bus->sdiodev->func[1]);
3663
3664         pr_debug("F1 signature read @0x18000000=0x%4x\n",
3665                  brcmf_sdio_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
3666
3667         /*
3668          * Force PLL off until brcmf_sdio_chip_attach()
3669          * programs PLL control regs
3670          */
3671
3672         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
3673                          BRCMF_INIT_CLKCTL1, &err);
3674         if (!err)
3675                 clkctl = brcmf_sdio_regrb(bus->sdiodev,
3676                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
3677
3678         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
3679                 brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
3680                           err, BRCMF_INIT_CLKCTL1, clkctl);
3681                 goto fail;
3682         }
3683
3684         if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
3685                 brcmf_err("brcmf_sdio_chip_attach failed!\n");
3686                 goto fail;
3687         }
3688
3689         if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
3690                 brcmf_err("unsupported chip: 0x%04x\n", bus->ci->chip);
3691                 goto fail;
3692         }
3693
3694         brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci,
3695                                           SDIO_DRIVE_STRENGTH);
3696
3697         /* Get info on the SOCRAM cores... */
3698         bus->ramsize = bus->ci->ramsize;
3699         if (!(bus->ramsize)) {
3700                 brcmf_err("failed to find SOCRAM memory!\n");
3701                 goto fail;
3702         }
3703
3704         /* Set core control so an SDIO reset does a backplane reset */
3705         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3706         reg_addr = bus->ci->c_inf[idx].base +
3707                    offsetof(struct sdpcmd_regs, corecontrol);
3708         reg_val = brcmf_sdio_regrl(bus->sdiodev, reg_addr, NULL);
3709         brcmf_sdio_regwl(bus->sdiodev, reg_addr, reg_val | CC_BPRESEN, NULL);
3710
3711         sdio_release_host(bus->sdiodev->func[1]);
3712
3713         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
3714
3715         /* Locate an appropriately-aligned portion of hdrbuf */
3716         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
3717                                     BRCMF_SDALIGN);
3718
3719         /* Set the poll and/or interrupt flags */
3720         bus->intr = true;
3721         bus->poll = false;
3722         if (bus->poll)
3723                 bus->pollrate = 1;
3724
3725         return true;
3726
3727 fail:
3728         sdio_release_host(bus->sdiodev->func[1]);
3729         return false;
3730 }
3731
3732 static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
3733 {
3734         brcmf_dbg(TRACE, "Enter\n");
3735
3736         sdio_claim_host(bus->sdiodev->func[1]);
3737
3738         /* Disable F2 to clear any intermediate frame state on the dongle */
3739         brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx,
3740                          SDIO_FUNC_ENABLE_1, NULL);
3741
3742         bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
3743         bus->rxflow = false;
3744
3745         /* Done with backplane-dependent accesses, can drop clock... */
3746         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
3747
3748         sdio_release_host(bus->sdiodev->func[1]);
3749
3750         /* ...and initialize clock/power states */
3751         bus->clkstate = CLK_SDONLY;
3752         bus->idletime = BRCMF_IDLE_INTERVAL;
3753         bus->idleclock = BRCMF_IDLE_ACTIVE;
3754
3755         /* Query the F2 block size, set roundup accordingly */
3756         bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
3757         bus->roundup = min(max_roundup, bus->blocksize);
3758
3759         /* bus module does not support packet chaining */
3760         bus->use_rxchain = false;
3761         bus->sd_rxchain = false;
3762
3763         return true;
3764 }
3765
3766 static int
3767 brcmf_sdbrcm_watchdog_thread(void *data)
3768 {
3769         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3770
3771         allow_signal(SIGTERM);
3772         /* Run until signal received */
3773         while (1) {
3774                 if (kthread_should_stop())
3775                         break;
3776                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
3777                         brcmf_sdbrcm_bus_watchdog(bus);
3778                         /* Count the tick for reference */
3779                         bus->sdcnt.tickcnt++;
3780                 } else
3781                         break;
3782         }
3783         return 0;
3784 }
3785
3786 static void
3787 brcmf_sdbrcm_watchdog(unsigned long data)
3788 {
3789         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
3790
3791         if (bus->watchdog_tsk) {
3792                 complete(&bus->watchdog_wait);
3793                 /* Reschedule the watchdog */
3794                 if (bus->wd_timer_valid)
3795                         mod_timer(&bus->timer,
3796                                   jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
3797         }
3798 }
3799
3800 static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
3801 {
3802         brcmf_dbg(TRACE, "Enter\n");
3803
3804         if (bus->ci) {
3805                 sdio_claim_host(bus->sdiodev->func[1]);
3806                 brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
3807                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
3808                 sdio_release_host(bus->sdiodev->func[1]);
3809                 brcmf_sdio_chip_detach(&bus->ci);
3810                 if (bus->vars && bus->varsz)
3811                         kfree(bus->vars);
3812                 bus->vars = NULL;
3813         }
3814
3815         brcmf_dbg(TRACE, "Disconnected\n");
3816 }
3817
3818 /* Detach and free everything */
3819 static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
3820 {
3821         brcmf_dbg(TRACE, "Enter\n");
3822
3823         if (bus) {
3824                 /* De-register interrupt handler */
3825                 brcmf_sdio_intr_unregister(bus->sdiodev);
3826
3827                 cancel_work_sync(&bus->datawork);
3828                 if (bus->brcmf_wq)
3829                         destroy_workqueue(bus->brcmf_wq);
3830
3831                 if (bus->sdiodev->bus_if->drvr) {
3832                         brcmf_detach(bus->sdiodev->dev);
3833                         brcmf_sdbrcm_release_dongle(bus);
3834                 }
3835
3836                 brcmf_sdbrcm_release_malloc(bus);
3837
3838                 kfree(bus);
3839         }
3840
3841         brcmf_dbg(TRACE, "Disconnected\n");
3842 }
3843
3844 static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
3845         .stop = brcmf_sdbrcm_bus_stop,
3846         .init = brcmf_sdbrcm_bus_init,
3847         .txdata = brcmf_sdbrcm_bus_txdata,
3848         .txctl = brcmf_sdbrcm_bus_txctl,
3849         .rxctl = brcmf_sdbrcm_bus_rxctl,
3850 };
3851
3852 void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
3853 {
3854         int ret;
3855         struct brcmf_sdio *bus;
3856         struct brcmf_bus_dcmd *dlst;
3857         u32 dngl_txglom;
3858         u32 dngl_txglomalign;
3859         u8 idx;
3860
3861         brcmf_dbg(TRACE, "Enter\n");
3862
3863         /* We make an assumption about address window mappings:
3864          * regsva == SI_ENUM_BASE*/
3865
3866         /* Allocate private bus interface state */
3867         bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
3868         if (!bus)
3869                 goto fail;
3870
3871         bus->sdiodev = sdiodev;
3872         sdiodev->bus = bus;
3873         skb_queue_head_init(&bus->glom);
3874         bus->txbound = BRCMF_TXBOUND;
3875         bus->rxbound = BRCMF_RXBOUND;
3876         bus->txminmax = BRCMF_TXMINMAX;
3877         bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
3878
3879         INIT_WORK(&bus->datawork, brcmf_sdio_dataworker);
3880         bus->brcmf_wq = create_singlethread_workqueue("brcmf_wq");
3881         if (bus->brcmf_wq == NULL) {
3882                 brcmf_err("insufficient memory to create txworkqueue\n");
3883                 goto fail;
3884         }
3885
3886         /* attempt to attach to the dongle */
3887         if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
3888                 brcmf_err("brcmf_sdbrcm_probe_attach failed\n");
3889                 goto fail;
3890         }
3891
3892         spin_lock_init(&bus->rxctl_lock);
3893         spin_lock_init(&bus->txqlock);
3894         init_waitqueue_head(&bus->ctrl_wait);
3895         init_waitqueue_head(&bus->dcmd_resp_wait);
3896
3897         /* Set up the watchdog timer */
3898         init_timer(&bus->timer);
3899         bus->timer.data = (unsigned long)bus;
3900         bus->timer.function = brcmf_sdbrcm_watchdog;
3901
3902         /* Initialize watchdog thread */
3903         init_completion(&bus->watchdog_wait);
3904         bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
3905                                         bus, "brcmf_watchdog");
3906         if (IS_ERR(bus->watchdog_tsk)) {
3907                 pr_warn("brcmf_watchdog thread failed to start\n");
3908                 bus->watchdog_tsk = NULL;
3909         }
3910         /* Initialize DPC thread */
3911         INIT_LIST_HEAD(&bus->dpc_tsklst);
3912         spin_lock_init(&bus->dpc_tl_lock);
3913
3914         /* Assign bus interface call back */
3915         bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
3916         bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
3917         bus->sdiodev->bus_if->chip = bus->ci->chip;
3918         bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
3919
3920         /* Attach to the brcmf/OS/network interface */
3921         ret = brcmf_attach(SDPCM_RESERVE, bus->sdiodev->dev);
3922         if (ret != 0) {
3923                 brcmf_err("brcmf_attach failed\n");
3924                 goto fail;
3925         }
3926
3927         /* Allocate buffers */
3928         if (!(brcmf_sdbrcm_probe_malloc(bus))) {
3929                 brcmf_err("brcmf_sdbrcm_probe_malloc failed\n");
3930                 goto fail;
3931         }
3932
3933         if (!(brcmf_sdbrcm_probe_init(bus))) {
3934                 brcmf_err("brcmf_sdbrcm_probe_init failed\n");
3935                 goto fail;
3936         }
3937
3938         brcmf_sdio_debugfs_create(bus);
3939         brcmf_dbg(INFO, "completed!!\n");
3940
3941         /* sdio bus core specific dcmd */
3942         idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
3943         dlst = kzalloc(sizeof(struct brcmf_bus_dcmd), GFP_KERNEL);
3944         if (dlst) {
3945                 if (bus->ci->c_inf[idx].rev < 12) {
3946                         /* for sdio core rev < 12, disable txgloming */
3947                         dngl_txglom = 0;
3948                         dlst->name = "bus:txglom";
3949                         dlst->param = (char *)&dngl_txglom;
3950                         dlst->param_len = sizeof(u32);
3951                 } else {
3952                         /* otherwise, set txglomalign */
3953                         dngl_txglomalign = bus->sdiodev->bus_if->align;
3954                         dlst->name = "bus:txglomalign";
3955                         dlst->param = (char *)&dngl_txglomalign;
3956                         dlst->param_len = sizeof(u32);
3957                 }
3958                 list_add(&dlst->list, &bus->sdiodev->bus_if->dcmd_list);
3959         }
3960
3961         /* if firmware path present try to download and bring up bus */
3962         ret = brcmf_bus_start(bus->sdiodev->dev);
3963         if (ret != 0) {
3964                 brcmf_err("dongle is not responding\n");
3965                 goto fail;
3966         }
3967
3968         return bus;
3969
3970 fail:
3971         brcmf_sdbrcm_release(bus);
3972         return NULL;
3973 }
3974
3975 void brcmf_sdbrcm_disconnect(void *ptr)
3976 {
3977         struct brcmf_sdio *bus = (struct brcmf_sdio *)ptr;
3978
3979         brcmf_dbg(TRACE, "Enter\n");
3980
3981         if (bus)
3982                 brcmf_sdbrcm_release(bus);
3983
3984         brcmf_dbg(TRACE, "Disconnected\n");
3985 }
3986
3987 void
3988 brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
3989 {
3990         /* Totally stop the timer */
3991         if (!wdtick && bus->wd_timer_valid) {
3992                 del_timer_sync(&bus->timer);
3993                 bus->wd_timer_valid = false;
3994                 bus->save_ms = wdtick;
3995                 return;
3996         }
3997
3998         /* don't start the wd until fw is loaded */
3999         if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN)
4000                 return;
4001
4002         if (wdtick) {
4003                 if (bus->save_ms != BRCMF_WD_POLL_MS) {
4004                         if (bus->wd_timer_valid)
4005                                 /* Stop timer and restart at new value */
4006                                 del_timer_sync(&bus->timer);
4007
4008                         /* Create timer again when watchdog period is
4009                            dynamically changed or in the first instance
4010                          */
4011                         bus->timer.expires =
4012                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
4013                         add_timer(&bus->timer);
4014
4015                 } else {
4016                         /* Re arm the timer, at last watchdog period */
4017                         mod_timer(&bus->timer,
4018                                 jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
4019                 }
4020
4021                 bus->wd_timer_valid = true;
4022                 bus->save_ms = wdtick;
4023         }
4024 }